Like users of other major technology brands, Meta product users are in the crosshairs of threat actors seeking to compromise accounts and access user data. With some 3 billion users, it is no surprise that Facebook is often front and center of phishing attack campaigns. Earlier this year, I reported on a surge in such campaigns aimed at compromising Facebook account passwords<\/a>, and now another report has warned of a new and dangerous attack called AccountDumpling that has already racked up tens of thousands of victims.<\/p>\n \u201cOver the past few weeks, we tracked waves of emails aimed at Facebook users, page admins, and operators,\u201d the Guard.io report<\/a> confirmed. Although the researchers found that the attacks used different lures and post-click paths, the destination was always the same: \u201cpeople controlling accounts with real financial value.\u201d Indeed, the attackers appear to have turned Google AppSheet into what you might call a phishing relay as part of an exploit loop which ultimately \u201csells the stolen accounts back through a storefront run by the same hands.\u201d<\/p>\n genuine resources for such account-compromising campaigns. PayPal users were targeted via a legitimate PayPal email<\/a> at the end of 2025. This time it is Google that is being abused by the scammers to get the exploit ball rolling, something that we have seen before with Google features being used to distribute malicious emails originating from trusted Google infrastructure<\/a>.<\/p>\n MORE FROM FORBES2.8 Billion Credentials Stolen As Password Attacks SurgeBy Davey Winder<\/a><\/p>\n In the case of the AccountDumpling Facebook campaign, the attackers are using the no-code Google AppSheet platform designed to automate workflows and notifications. The threat actors were found to be abusing the AppSheet notification mechanism to deliver phishing emails at scale. \u201cThere was no need for spoofing, no reliance on compromised Google accounts,\u201d Chen confirmed, \u201cjust a service doing exactly what it was built to do.\u201d As Chen said, a fully authenticated email proves only that the platform sent it, not that the message itself is trustworthy. And, oh boy, these ones certainly are not.<\/p>\n Although a number of different email messages were used, mostly of the panic-inducing variety, such as warnings that the recipient\u2019s Facebook account would be disabled, or a copyright claim that needed to be addressed, the one that stood out for me was the blue badge offer. No panic required, just temptation. \u201cGet your free blue Facebook badge,\u201d the emails promised. No need to pay for a Meta Verified subscription<\/a>, just jump through a few fake CAPTCHA<\/a> and contact detail hoops, before entering a password and a few rounds of 2FA codes. The evasion stack used by the attackers for this particular lure was \u201cthe most layered we saw at the email stage.\u201dSender display names padded with spaces using Unicode invisible characters, body text with words broken halfway through to confuse contextual text detection and even Cyrillic homoglyphs in the footer Meta branding that looked identical to Latin characters.<\/p>\n I have reached out to Meta for a statement regarding the new attack campaign report and advice for Facebook users. In the meantime, however, there\u2019s a useful support page at the Meta Help Center on how to avoid scams and phishing attempts<\/a> that I recommend you refer to.<\/p>\n MORE FROM FORBESGmail Accounts Under Persistent Hacking Attacks\u2014\u2018Always Be Wary\u2019By Davey Winder<\/a><\/p>\n![\"\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/05\/4b90cf1a5710c88ca49475530074aee9.jpeg\"\/)
<\/a>Blue Badge Facebook Attacks\u2014AccountDumpling Campaign Exposed<\/p>\n![\"\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/05\/d1a5b3bda881a4eec82c659603eb7105.jpeg\"\/)
<\/a><\/p>\n
![\"\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/05\/f4f1dec567e1eb6dd6a817b8ac4aaea6.jpeg\"\/)
<\/a><\/p>\n