Massive Facebook Phishing Operation Leverages AppSheet, Netlify, and Telegram

Guardio Labs uncovered 'AccountDumpling', a sophisticated phishing campaign that compromised ~30,000 Facebook accounts by abusing Google AppSheet to send fully authenticated phishing emails that bypass SPF/DKIM/DMARC; attackers used multi-cluster infrastructure (Netlify, Vercel, Google Drive) to host bespoke phishing pages, real-time Socket.IO panels to capture MFA and session data, and Telegram bots to exfiltrate and monetize stolen account access, with links to Vietnamese operators discovered in document metadata and source comments.