Taiwanese Facebook Biz Pages Fall to Infostealer Phishing Campaign

Cisco Talos observed a phishing campaign active since at least July targeting Facebook businesses and advertising account users in Taiwan: attackers send decoy emails (impersonating legal teams and known merchants) claiming copyright infringement to coerce victims into downloading malware. The campaign deploys information stealers (Lumma Stealer, Rhadamanthys) embedded in legitimate binaries and uses evasion techniques—shellcode encryption and code obfuscation—to bypass antivirus and sandbox analysis.