ClickFix Facebook Session Hijacking Campaign Targets Creators at Scale

This report details the ClickFix phishing campaign that tricks Facebook creators and business pages into handing over live session cookies (c_user and xs) via multi-stage fake verification and appeal pages; attackers then exfiltrate tokens and, if needed, backup codes and passwords using third-party serverless form backends. The analysis enumerates ~115 pages, 103 hostnames, multiple exfiltration endpoints (submit-form.com, Formspark, shiper.app), title- and template-based pivots, operational guidance for defenders, and mapped MITRE ATT&CK techniques.