{"id":24394,"date":"2025-10-02T10:00:00","date_gmt":"2025-10-02T08:00:00","guid":{"rendered":"https:\/\/defenderbox.de\/?p=24394"},"modified":"2026-03-11T17:55:01","modified_gmt":"2026-03-11T16:55:01","slug":"facebook-phishing","status":"publish","type":"post","link":"https:\/\/defenderbox.de\/en\/facebook-phishing\/","title":{"rendered":"New phishing wave"},"content":{"rendered":"
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Facebook redirects <\/b><\/h2>\n

In recent weeks, security teams have observed a sophisticated wave of phishing: Facebook's own forwarding mechanism is being misused to redirect users to deceptively real login replicas and steal login data.<\/p>\n

The attackers disguise malicious targets behind seemingly legitimate Facebook URLs (e.g. l.facebook.com\/l.php?u=...), exploiting both automated scanners and human trust in the Facebook domain.<\/p>\n

Tactics<\/span><\/h3>\n

The phishing emails are formulated as urgent security warnings or account notifications. They are visually based on the Facebook style and use social engineering to persuade recipients to click.<\/p>\n

The link initially shows a Facebook domain and thus creates a feeling of credibility. Ultimately, however, the URL redirects to an attacker infrastructure that is an almost perfect copy of the Facebook login page.<\/p>\n

Once the credentials have been entered, they are sent to the attackers. In some cases, the fake page then generates an \"incorrect password\" message to persuade the victim to enter a second set of credentials - and thus obtain the valid credentials.<\/p>\n

Why this technique is so effective<\/span><\/h3>\n

Forwarding services of large platforms legitimately serve as a protection mechanism, while at the same time generating trust among users.<\/p>\n

Attackers reverse this advantage of trust: The legitimate domain serves as a cloak for the malicious target address, bypassing email gateways and user skepticism. The campaign is also rolled out in several languages, which significantly increases its reach.<\/p>\n

Concrete protective measures for companies and IT teams<\/span><\/strong><\/h4>\n
    \n
  1. Be suspicious of links - always check the final target URL (hover\/link preview) and do not follow blindly.<\/li>\n
  2. Enforce Multi-Factor Authentication (MFA) - even with compromised passwords, MFA significantly reduces the damage.<\/li>\n
  3. Hardening email security - integrating URL reputation, link sandboxes and heuristic analyses.<\/li>\n
  4. Phishing simulation and awareness programs<\/a> - Repeated training significantly reduces click rates.<\/li>\n<\/ol>\n

    Conclusion<\/strong><\/p>\n

    This campaign shows: Attackers are adapting and using legitimate platform functions to their advantage.<\/p>\n

    For companies, this means not only strengthening technical defenses, but also processes, Awareness<\/a> and responsiveness on an ongoing basis.<\/p>\n

    If you take action now - roll out MFA, carry out phishing checks and train employees - you will significantly reduce the risk.<\/p>\n

    With the DEFENDERBOX<\/a> we offer companies a proactive approach to cyber security:<\/p>\n