Forest Global Training Partners

Cyber Risks · Cisco Talos

Hiding in plain sight: How adversaries are using Facebook groups

Summary: Cisco Talos compiled a list of 74 Facebook groups, with roughly 385,000 members combined, where members traded stolen bank and credit card data, account credentials, and email spamming tools and services. Some of these groups, with names like "Spam Professional" and "Facebook hack (Phishing)," stayed on the platform for up to eight years, and although Facebook's security team took down most after Talos made contact, new groups continue to appear. Talos traced spam advertised in one group to its own telemetry, where an Apple-themed PDF invoice led to a phishing site on a recently registered domain built with the 16Shop phishing kit.

What you should know: An attacker with even the smallest foothold inside an organization can do considerable damage, and these groups give anyone with a Facebook account a searchable marketplace for the credentials and phishing kits that get them that foothold.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026