Phishing Scams Exploiting Common Apps and Meta's Countermeasures
Cybercriminals have increasingly weaponized common applications such as email, messaging platforms, and social media to conduct sophisticated phishing scams targeting users worldwide. Attackers frequently use seemingly innocuous PDF attachments in emails, which are crafted to appear as official documents from trusted brands like Microsoft, DocuSign, or PayPal. These emails often employ urgent subject lines to create a sense of immediacy, prompting recipients to open the attachments. The PDFs themselves are professionally styled and contain official logos, further enhancing their credibility. Victims are typically instructed to call a customer service number, where they are met by impersonators who attempt to extract sensitive information or trick them into installing malware. In addition to email-based attacks, cybercriminals are leveraging vishing techniques, using phone calls—including those made via messaging apps like WhatsApp—to deceive users into revealing confidential data. These calls often originate from foreign numbers and use automated voices to increase the likelihood of success. Recognizing the growing threat, Meta has introduced new security tools for WhatsApp and Messenger to help users identify and avoid scams. On WhatsApp, users now receive warnings when attempting to share their screen with unknown contacts during video calls, reducing the risk of inadvertently disclosing sensitive information. Messenger users can enable a 'Scam detection' feature, which alerts them to suspicious messages from unknown senders and offers the option to submit messages for AI review. If a scam is detected, users are provided with educational information about common scam tactics and options to block or report the sender. Meta has also taken significant action against scam operations, removing over 21,000 Facebook Pages and accounts impersonating customer support representatives. Furthermore, the company has disrupted nearly 8 million accounts linked to criminal scam centers operating from countries such as Myanmar, Laos, Cambodia, the UAE, and the Philippines. These scam centers target individuals globally through various platforms, including messaging, dating apps, and cryptocurrency services. The scams often involve romance baiting and fraudulent job offers, exploiting users' trust and financial vulnerability. Meta's efforts underscore the scale and sophistication of modern phishing campaigns and the necessity for ongoing vigilance and technological defenses. Users are advised to remain cautious when interacting with unsolicited communications, especially those requesting sensitive information or urgent action. The combination of technical countermeasures and user education is critical in mitigating the risks posed by these evolving phishing threats. Organizations and individuals alike must stay informed about the latest tactics used by cybercriminals and adopt best practices to safeguard their information. The ongoing battle between attackers and defenders highlights the dynamic nature of the cybersecurity landscape and the importance of proactive security measures.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Security researchers highlight phishing scams abusing common apps
A subsequent report described phishing and scam campaigns that weaponize common apps to trick users, providing broader context for the threat landscape these protections address. The coverage emphasized how attackers exploit familiar applications and interfaces to deceive victims.
Meta rolls out new anti-scam tools for WhatsApp and Messenger
Meta announced new protections for WhatsApp and Messenger users aimed at reducing scams and phishing attempts on its messaging platforms. Multiple reports describe the rollout as a product security update focused on protecting users from fraudulent messages and app-based social engineering.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Meta boosts scam protection on WhatsApp and Messenger
malwarebytes.com
Open sourcePhishing Scams Weaponize Common Apps to Fool Users
securityboulevard.com
Open sourceMeta Rolls Out New Tools to Protect WhatsApp and Messenger Users from Scams
thehackernews.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Social Engineering Scams Exploiting Mobile Device Features to Steal Credentials and Funds
Cybercriminals are increasingly leveraging built-in features of popular mobile platforms to execute sophisticated social engineering scams aimed at stealing sensitive credentials and financial assets. On WhatsApp, scammers exploit the screen-sharing function by impersonating trusted entities such as bank employees or support agents, coercing victims into sharing their screens under the pretense of resolving urgent security issues. This access enables attackers to view and capture one-time passwords (OTPs), banking details, and other personal information, resulting in significant financial losses. In response, Meta has introduced AI-powered safety tools, including real-time warnings when users attempt to share their screens with unknown contacts, to mitigate these attacks. Similarly, iPhone users are being targeted through phishing campaigns that exploit the "Find My" feature. After a device is lost or stolen, scammers send convincing fake messages—purportedly from Apple Support—containing links that claim to help locate the missing phone. By leveraging accurate device details and the victim's sense of urgency, attackers trick users into divulging their Apple ID credentials, potentially granting full access to personal data and accounts. Authorities such as Switzerland’s National Cyber Security Centre have issued warnings about these tactics, emphasizing the need for heightened vigilance when responding to unsolicited messages related to lost devices.
Jun 29, 2026
Phishing Campaigns Exploiting Email Trust Mechanisms for Credential Theft
Attackers have launched multiple sophisticated phishing campaigns targeting business users by exploiting trusted email mechanisms and brand impersonation. One campaign abused the legitimate `@facebookmail.com` domain and Meta Business Suite’s invitation feature to send convincing phishing emails to Facebook Business users, primarily targeting companies in sectors like automotive, education, real estate, hospitality, and finance. These emails, which appeared authentic due to their origin from Meta’s infrastructure, redirected victims to credential harvesting sites, with some organizations receiving thousands of such messages. The attackers created fake business pages and mimicked official branding to increase the likelihood of success, as confirmed by security researchers who reproduced the attack method. Other campaigns have leveraged HTML attachments and spoofed internal notifications to bypass traditional email security. In Central and Eastern Europe, phishing emails with malicious HTML attachments embedded JavaScript to steal credentials, impersonating brands like Adobe and Microsoft and transmitting stolen data to attacker-controlled Telegram bots. Another campaign disguised phishing emails as spam filter alerts from within the victim’s own organization, using obfuscated code and personalized fake login screens to harvest credentials via websockets. These evolving tactics highlight the increasing sophistication of phishing operations and the need for organizations to monitor for unusual connections, inspect email content, and educate users about the risks of unsolicited attachments and internal-looking notifications.
Jun 29, 2026
Meta Expands AI Scam Defenses After Disrupting Southeast Asia Fraud Networks
Meta announced new anti-scam protections across **Facebook, Messenger, and WhatsApp** as it faces growing scrutiny over fraud on its platforms. The company said its AI systems now analyze **text, images, and contextual signals** to detect celebrity and brand impersonation, deceptive links, domain spoofing, and other social-engineering tactics. New measures include Facebook warnings for suspicious friend requests, WhatsApp alerts for risky device-linking attempts involving QR codes or phone-number entry, and expanded Messenger scam detection that can, with user consent, review recent chats for fraud indicators. Meta also detailed privacy-focused link protection in Messenger through **Advanced Browsing Protection**, which checks shared URLs against a large malicious-site watchlist without exposing readable links to Meta. The product rollout follows a broader crackdown on industrialized scam operations, including joint action with the **Royal Thai Police**, **FBI**, **UK National Crime Agency**, and **Australian Federal Police** that led to **21 arrests** and the disabling of more than **150,000 accounts** tied to Southeast Asian scam compounds. Meta said it removed **159 million scam ads in 2025** and took down about **10.9 million Facebook and Instagram accounts** linked to criminal scam centers, while shifting from deleting individual accounts to disrupting entire networks. The push comes as researchers separately documented a large malvertising operation using **300+ paid Meta ad campaigns** to impersonate news outlets and public figures, lure victims to spoofed sites, harvest contact details, and funnel them into call-center-run investment scams across at least **25 countries**.
Jun 29, 2026