The Meta 2FA Trap: From Verified Badge to Account Takeover

MITRE Techniques

• [T1566.002 ] Phishing: Spearphishing Link – The campaign uses an email containing a link that redirects recipients to a Google Form to harvest credentials (‘lure recipients into clicking a Google Form and submitting their login credentials’).
• [T1566.003 ] Phishing: Spearphishing via Service – Threat actors abuse legitimate services (Google Forms/Docs) to host convincing phishing pages and collect sensitive data (‘the document itself is legitimate, it has been crafted by the threat actor using a convincing template to mimic Meta’s verification process’).
• [T1204.002 ] User Execution: Malicious Link – The attack relies on user interaction (clicking the embedded phishing URL) to begin the multi-stage credential collection flow (‘Embedded in the body of the email is the phishing URL redirect that goes to a Google Form’).
• [T1583.004 ] Acquire Infrastructure: Web Services – Adversaries host phishing pages on legitimate web service providers (vercel.app) to appear credible and evade detection (‘the “vercel.app” domain is a legitimate hosting service that is commonly abused by threat actors to create phishing pages impersonating trusted brands’).
• [T1078 ] Valid Accounts – Harvested credentials and real-time 2FA tokens are used to immediately log into and take over victim accounts (‘the token and credentials will be used to log into the user’s account almost immediately’).