Social media platforms are a prime target for hackers and scammers. They hijack accounts to steal data, spread malware and dangerous lies.

A hacker who gains access to one of your accounts can use your information to gain access to other accounts. A security researcher was recently able to access Facebook accounts logged in with Gmail credentials. Tap or click here for our report.

Facebook Messenger is used by nearly a billion people every month. Of course, this makes it irresistible to cyber criminals. A new phishing attack that steals login credentials is making the rounds in Messenger. Here’s how it works and how to avoid it.

Here is the backstory

With so many people using Messenger, Facebook uses chatbots to communicate with customers. This is standard practice for many large companies. Chatbots act as live support and answer your questions or use them to direct you to the appropriate customer support representative.

Trustwave discovered a phishing campaign targeting people who run Facebook pages. It starts with an email claiming that your page will be shut down within 48 hours for violating Facebook’s Community Standards. Since many break these rules without realizing it, the threat seems legitimate.

Here is an example of what the message might look like:

You can appeal the decision by clicking on the “Appeal Now” link. This opens a Messenger conversation with a chatbot. If you are not signed in to Messenger, you will be prompted to do so. This is a legit Messenger chat box. The chatbot, however, is an impostor.

RELATED: Is this viral Facebook post about “cloning” accounts true or false?

Something is wrong with this account

The profile behind the “chatbot” is a typical Facebook page with no followers or posts (red flags under any circumstances). Yet this seemingly inactive page is rated as “Very Responsive,” meaning the manager responds to 90% of messages within 15 minutes.

The page even uses the Messenger logo as its profile picture. A little on the nose, don’t you think?

The fake chatbot sends another Call Now button in the conversation. Clicking on it takes you to a site posing as a Facebook “support inbox”. Trustwave was quick to point out that the case number in the page’s support URL does not match that of the support inbox URL.

Scroll through the “Open” and “Call” buttons that don’t even work, and you’ll find fields to fill in name, phone number, and email address. Submit the information and you will get a pop-up asking for your password. If you haven’t felt suspicious so far, this should do it.

Your information is all sent to the database of scammers. But they’re not done with you yet.

A final parting gift

You are then redirected to a fake two-factor authentication page which asks for the six-digit PIN you just texted to your phone. It doesn’t matter what you enter – they have all your information, and now they’re just trying to look more legit.

The last step in the scheme is to redirect you to the actual Facebook Help Center page. Fortunately, the fake Facebook support page and the phishing website have been taken down. This does not mean that this type of scam cannot happen again.

What to pay attention to

There are steps you can take to protect your Facebook account. In fact, these general guidelines apply to almost any account you have:

• Never click on a link or download an attachment from an unsolicited email or message.
• Set up two-factor authentication (2FA) on all accounts that offer it, including social networks and banking sites. The added security method greatly reduces your chances of being hacked, as you have to manually check all login attempts.
• Typos and sloppy errors are the main red flags.
• Keep your operating systems, apps, and devices updated with the latest official software and patches.
• Have reliable antivirus software on all your devices. We recommend our sponsor, TotalAV. Right now, get an annual plan of TotalAV Internet Security for just $19 at ProtectWithKim.com. That’s over 85% off the regular price!

keep reading

Facebook is monitoring your every move – Here’s the proof

There’s a Second Hidden Message Folder on Facebook – Here’s How to Find It