New OG Spoof Toolkit Manipulates Social Media Links for Cybercrime

Cyble Research highlights the emergence of the "OG Spoof" toolkit — a commercially available tool sold by a Russian threat actor that manipulates Open Graph metadata to create deceptive social media previews and redirect users to malicious sites. The toolkit integrates with Cloudflare for domain/DNS management, supports separate display and redirect URLs with real-time redirect updates, integrates with advertising platforms to amplify distribution, and provides team and analytics features; these capabilities enable phishing campaigns to evade platform moderation and update link destinations after initial approval, increasing the risk of large-scale credential theft and fraud.