2 posts
Threat actors are executing account takeover campaigns by distributing malware disguised as video games via compromised Discord accounts. Upon gaining initial access to a victim's Google account, attackers abuse the Family Link parental control feature by changing the victim's age to under 13 and assigning a malicious parent account. This allows the attackers to reset the password, bypass 2-Step Verification, lock the legitimate user out completely, and demand a ransom for account recovery.
A credential phishing campaign identified by the Cofense Phishing Defense Center targets Meta (Facebook/Instagram) account holders, particularly page administrators, by impersonating Meta's verification badge program. The multi-stage attack chain routes victims through a spoofed Gmail sender to a Google Form, then to a Vercel-hosted phishing page that collects PII, passwords, and 2FA tokens in real time — enabling near-instant account takeover before TOTP codes expire. The abuse of legitimate hosting infrastructure (Google Forms, Vercel) allows the campaign to bypass conventional URL-reputation and email security controls.
