Attackers Hijack Facebook Pages, Promote Malicious AI Photo Editor

Researchers discovered a malvertising campaign that hijacks Facebook pages via phishing to promote a fake AI photo editor; victims download a legitimate ITarian endpoint utility that ultimately delivers the Lumma infostealer to Windows machines (about 16,000 Windows downloads reported). The campaign leverages social engineering, paid ads, and page takeover to harvest credentials, browser data, and system details; recommended mitigations include MFA, strong unique passwords, user awareness training, and account monitoring.