{
  "Event": {
    "analysis": "1",
    "date": "2026-07-07",
    "extends_uuid": "",
    "info": "[Threat Intel] Phishers Abuse Business Account Manager Service",
    "protected": false,
    "publish_timestamp": "1784349310",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784349309",
    "uuid": "0519cd59-6a6f-41cb-a059-566683e18679",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#8f20d0",
        "local": false,
        "name": "misp-galaxy:producer=\"Huntress\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"vietnam\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783652419",
        "to_ids": false,
        "type": "link",
        "uuid": "30c21ea0-f51a-4feb-9f41-66710f15c9f1",
        "value": "https://www.huntress.com/blog/meta-business-manager-phishing"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783652419",
        "to_ids": false,
        "type": "text",
        "uuid": "4340f70e-e761-4304-8308-556637fcbda0",
        "value": "An unknown threat actor exploited Meta's Business Account Manager service to send phishing emails from legitimate Meta addresses between November 2025 and June 2026. The attackers manipulated the business partner mechanism by embedding URLs in the business name field, causing emails to appear as legitimate Meta communications. The campaign evolved to incorporate Facebook Messenger chatbots and exfiltrated stolen credentials, MFA codes, phone numbers, and identity documents to a private Telegram channel. The phishing pages impersonated Meta's Agency Partner Program and Verified badge services, targeting businesses to capture account credentials. Meta responded by implementing detections and blocking accounts attempting to use URLs in business names. Vietnamese language elements in the exfiltration process suggest the attackers' possible origin."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1783652419",
        "to_ids": false,
        "type": "text",
        "uuid": "30278d35-d1c8-44a6-91b1-c3c32c16f0f0",
        "value": "Name: Phishers Abuse Business Account Manager Service\nAuthor: AlienVault\nAdversary: \nTags: [\"credential theft\", \"telegram exfiltration\", \"vietnamese threat actor\", \"business account manager abuse\", \"meta phishing\", \"facebook messenger chatbot\", \"identity document theft\", \"mfa bypass\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: []\nIndustries: [\"Technology\", \"Media\"]"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784345333",
        "to_ids": true,
        "type": "url",
        "uuid": "d7f7e17d-d0f6-4daa-8a69-fa3db0fc0c79",
        "value": "https://sw.run/Verification",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784345354",
        "to_ids": true,
        "type": "domain",
        "uuid": "eff639a1-d858-4311-a47d-3c63d2d1aa0d",
        "value": "aussiecleaningservices.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784345375",
        "to_ids": true,
        "type": "hostname",
        "uuid": "1462418c-082d-4563-b06b-d42c72f6a1fc",
        "value": "api.goautolink.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}