Facebook Login Theft via New Phishing Trap

Cybercriminals have developed a sophisticated phishing method specifically targeting Facebook users’ login credentials, according to the cybersecurity firm Trellix. Over the past six months, the use of a technique known as “Browser-in-Browser” (BiB) has surged significantly, the company reported. Experts warn that this strategy is particularly deceptive and difficult for ordinary users to detect.

Trellix researchers explained that in a BiB attack, users who visit websites controlled by cybercriminals are presented with a fake browser pop-up window prompting them to log in to Facebook. While this pop-up appears indistinguishable from a legitimate login window, it is, in fact, a fabricated interface created using an iFrame. The fake login option mimics Facebook’s authentic page in appearance, including the page title and web address, making it extremely convincing. Any usernames or passwords entered into this fraudulent form are immediately transmitted to the attackers, giving them full access to the victim’s account.

In addition to BiB attacks, cybersecurity specialists note that Facebook login information is also being stolen through a large number of traditional phishing pages. Many of these pages imitate Meta’s design and often warn users of copyright violations or threaten temporary account suspension, pressuring users to “update” their information. Compared to conventional phishing attempts, these attacks are far more complex and dangerous. Trellix’s report highlights that perpetrators exploit legitimate cloud infrastructure and URL-shortening technologies to bypass standard security measures, increasing the attack’s effectiveness.

To mitigate risks, cybersecurity experts advise users never to click on links within emails or messages claiming security alerts or account policy violations. Instead, users should access Facebook directly through a new browser tab or the official app. Enabling multi-factor authentication (MFA) consistently is also recommended to enhance account security.

The following table summarises the main types of Facebook phishing attacks and their associated risks:

Experts emphasise the importance of vigilance and recommend that users regularly check security settings, avoid suspicious links, and maintain MFA for all online accounts. These measures significantly reduce the likelihood of falling victim to increasingly sophisticated phishing schemes.