Facebook Graph Search API Used To Brute Force Phone Numbers From Profiles

A Security Ledger article describes a proof-of-concept Recon-ng module, “Facebook Harvester,” that leverages Facebook’s Graph Search API to link phone numbers (including via partial numbers) to Facebook profiles, exposing names, usernames and phone digits. The report notes the module requires a short-lived developer auth token and is subject to API rate limits, highlights privacy and social-engineering risks, and frames the tool as useful for penetration testers but potentially abusable by malicious actors.