“AccountDumpling” Hijacked Google Infrastructure to Steal 30,000 Facebook Accounts

Guardio Labs uncovered "AccountDumpling," a sophisticated phishing campaign that abused Google AppSheet to deliver authenticated, signed phishing emails and compromise approximately 30,000 Facebook accounts; the operation uses multiple attack clusters (cloned help centers, fake verification rewards, real-time human-in-the-loop panels, and fake job offers), exfiltrates data to Telegram-based C2 bots, and is linked via document metadata to a Vietnamese individual allegedly monetizing account recovery services.