A sophisticated attack exploits Google AppSheet to hack 30,000 Facebook accounts
A group of cybercriminals linked to Vietnam exploited Google's infrastructure to carry out a large-scale phishing attack, compromising 30,000 Facebook business accounts in 50 countries. The peculiarity of this campaign, dubbed AccountDumpling, lies in the use of Google AppSheet, a no-code platform, to send phishing emails that bypass traditional authentication systems.
The mechanism of the attack
The hackers abused AppSheet's features to send seemingly legitimate emails from a "noreply@appsheet.com" address. Thanks to the inherent trust associated with Google services, these emails managed to evade anti-spam and anti-phishing filters, reaching the victims' inboxes directly.
The emails contained fake copyright violation notices from Meta, threatening account closure and inviting users to click on malicious links to verify their credentials. In some cases, the attackers also impersonated recruiters from major companies like Apple, Coca-Cola, and Meta itself, offering job opportunities to convince victims to participate in calls hosted on sites controlled by the aggressors.
The infrastructure behind the attack
The hackers exploited cloud services like Google Drive, Netlify, and Vercel to host fake sites or documents containing malware. Once the victims entered their credentials, the data was automatically forwarded to Telegram channels controlled by the attackers, where operators validated the information to quickly take control of the accounts.
The attack chain suggests a well-coordinated operation, with a repeatable process for account compromise. The aggressors, linked to the site phamtaitan.vn, seem to specifically target Facebook business accounts and advertisers, which often contain sensitive financial and personal data.
Geographical impact
The attack affected victims worldwide, with the most affected countries including the United States, Italy, Canada, the Philippines, India, Spain, Australia, the United Kingdom, Brazil, and Mexico. The compromised accounts were used for various illegal purposes, including publishing fraudulent ads, executing scams through hijacked pages, and selling account access on dark markets.
In some cases, the attackers themselves offered account recovery services to victims, adding an additional layer of deception.
Security implications
This attack highlights a concerning trend in the cyber threat landscape: the use of legitimate platforms to conduct malicious campaigns. Shaked Chen, a security researcher at Guardio, defined this approach as a "phishing relay," where trusted systems act as intermediaries for malicious campaigns.
For security teams, protecting organizations requires proactive threat intelligence. Guardio published a detailed report with the indicators of compromise (IOCs) of this campaign, which can be used to strengthen defenses against similar attacks.
The need for greater awareness
Despite the use of legitimate infrastructure to increase the effectiveness of attacks, experts emphasize that visible traces remain that can be identified with careful analysis. The AccountDumpling campaign serves as a warning about the need for greater awareness and vigilance by users and organizations.
In a context where stolen credentials, exposed systems, and trusted infrastructures continue to pose recurring risks, it is fundamental to adopt preventive measures and train users to recognize and resist these sophisticated threats.
The broader context
This attack fits into a broader context of increasingly sophisticated cyber threats. According to TechRepublic data, among the largest cyber attacks of 2026, stolen credentials and the abuse of legitimate infrastructures remain among the main attack vectors.
Joseph, the author of the report, is a cybersecurity expert with a passion for the responsible use of technology. Through his experience as a technical writer and his leadership in a community of technology enthusiasts, he actively contributes to raising awareness and knowledge about cybersecurity.
The broader context
The evolution of phishing tactics
The AccountDumpling campaign represents a significant evolution in phishing tactics. Traditionally, cyber attacks relied on imitating legitimate platforms to deceive users. However, attackers are now directly exploiting trusted infrastructures like Google AppSheet to increase the effectiveness of their campaigns.
This approach, defined as "phishing relay" by researcher Shaked Chen, leverages the inherent trust that users place in services like Google. Emails sent through AppSheet, for example, present verification signs that many users use to quickly judge the legitimacy of a message.
The use of legitimate platforms not only increases the success rate of attacks but also reduces suspicion from both users and security systems. This tactical shift requires organizations to adopt more robust defense measures and invest in proactive threat intelligence solutions.
Challenges for security teams
Protecting organizations from attacks like AccountDumpling requires a multi-phase approach. First, it is essential to implement advanced threat analysis solutions that can identify anomalous patterns and suspicious behaviors within business communications.
Additionally, security teams must work closely with cloud service providers to improve authentication mechanisms and detect malicious activity. Integrating real-time threat monitoring tools can help quickly identify and mitigate phishing campaigns.
Finally, continuous user training is fundamental. Even with the most secure infrastructures, phishing attacks still exploit human weaknesses. Educating employees to recognize the signs of a phishing attack and follow security procedures can significantly reduce the risk of compromise.
Legal and regulatory implications
The abuse of legitimate platforms to conduct phishing attacks raises important legal and regulatory issues. Companies like Google could be held accountable for the misuse of their infrastructure, with potential consequences including fines and loss of customer trust.
Regulatory authorities might also scrutinize the security practices of cloud platforms more closely, imposing stricter requirements to prevent the abuse of their infrastructure.
The future of cybersecurity
The AccountDumpling campaign is an example of how attackers are becoming increasingly sophisticated in using legitimate technologies for their malicious purposes. This trend underscores the need for a proactive approach to cybersecurity, combining advanced technologies, user training, and collaboration among organizations.
Companies must invest in cutting-edge security solutions and adopt a security-by-design mindset, integrating protective measures at every stage of their development and operations. Additionally, sharing threat information among organizations can help identify and mitigate malicious campaigns more quickly.
Finally, user awareness and vigilance remain crucial. Even with the best security technologies, phishing attacks still exploit human weaknesses. Educating users to recognize and resist these threats is essential to protect organizations and their data.
Conclusions
The AccountDumpling attack highlights a concerning trend in the cyber threat landscape: the use of legitimate platforms to conduct malicious campaigns. This approach requires organizations to adopt more robust defense measures and invest in proactive threat intelligence solutions.
Protecting organizations requires a multi-phase approach that combines advanced technologies, user training, and collaboration among organizations. Additionally, the legal and regulatory implications of such attacks underscore the need for a stricter regulatory framework to prevent the abuse of cloud infrastructures.
In a context where cyber threats continue to evolve, user awareness and vigilance remain fundamental. Educating users to recognize and resist these threats is essential to protect organizations and their data.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.