Anatomy of a Meta-impersonation phishing campaign

Three fake “Meta” emails in one week → sent from hijacked government and school accounts that passed every spam filter → a credential-and-identity harvester that stayed unflagged for 8 days → reported to the FBI via IC3

Why this case is public

This is a live phishing campaign that targeted L0GIC’s own business inbox. We tore it down the way we’d tear down an attack for a client — from the email headers and the page’s own source — and published the result. Every step here was passive analysis: reading what was already sent to us. No attacker system was accessed.

The same instinct that makes a good phishing lure — “this looks official, act fast” — is exactly what forensics is built to slow down and read. The give-aways were all in the metadata. The copy never gives them away; the envelope always does.

What happened

Between August 1 and August 7, 2026, our business email received three phishing emails impersonating Meta / Facebook — an advertising “compliance review,” a blue-badge “verification” offer, and a brand-enforcement “final warning.” All three aimed to steal Meta account credentials, two-factor codes, and identity documents. Different pretexts, one shared phishing kit: this was a coordinated campaign, not spray-and-pray spam.

They reached us the ordinary way. We had just run a Meta ad carrying our email address — and Meta publishes every ad in its public, continuously-scraped Ad Library. The lures were advertising-themed because the operator could see we were advertising. No breach of Meta was required; the target list was public.

The attack chain

The whole operation is visible in the email envelope and the landing page’s own JavaScript. Each stage below is reconstructed from the message headers and the page source — nothing here rests on our say-so.

Attack chain · hijacked account to Telegram drop Reconstructed from email headers + page source

[1]Hijacked sender⚠

Sent from real, compromised Google Workspace accounts — one on a Vietnamese school subdomain, one on a Southeast-Asian government education domain. Because the accounts are genuine, the mail passed SPF and DKIM cleanly. The authentication was real; the authority was stolen. The government account passed DMARC aligned to its own domain — it is a compromised victim, not the attacker.

authenticated send through Google · passes every filter

[2]The lure⚠

A polished “Meta” enforcement notice with a single “Submit Appeal” button. The body reads clean on a skim — but it announced the outcome of a review period that had not ended yet (see the scorecard below). Well-written copy, give-away metadata.

click → the doorway page

[3]The 6-second cloak⚠

The link did not open a login. It opened a 6-second video — a slick “Meta” loading animation — and only then did JavaScript (setTimeout…6000) redirect to the real trap. An automated scanner that fetches the link sees only a video. This is almost certainly why Google Safe Browsing had not flagged the page 8 days after we received it.

redirect → the harvester · hosted on Cloudflare Workers (free tier)

[4]The harvester⚠

A Meta-branded form that showed a fake “incorrect password” error to harvest a second password, then asked for a two-factor code four times on a 30-second timer — the rotation period of a TOTP code, the signature of a live operator relaying codes in real time. It also requested phone number and government ID. Full account takeover plus identity theft.

exfiltrated on the first submit, not the last

[5]The drop — a Telegram bot

Every field was posted to a Telegram bot, hardcoded in the page’s own JavaScript. The bot token was recovered by reading the source — never used — and reported to law enforcement. It is not published here: it is a live credential, and the channel it feeds may hold other victims’ stolen data.

Emails 3 / 7 days Unflagged 8 days Steals pw ×2 · 2FA ×4 · ID

A message that passes every authentication check, a payload cloaked from automated scanners, and a harvester engineered to defeat two-factor auth and password managers alike — all assembled from a reused kit on free infrastructure, and all readable from the metadata it could not hide.

The tells: 7 signs, every one free to check

Before any expertise, the emails were identifiable as fraudulent from the message itself. The scorecard shows each sign twice: the technical detail for reviewers, and a plain-English translation for anyone with no security background.

Warning signs in the message

7 / 7

readable in the email itself

✗

SIGN 1It reported a result that hadn’t happened yet

LogicEmail sent mid-way through its own stated “Review period” — announcing the outcome with hours still left to run

In plain EnglishIt told us we’d failed a review that, by its own dates, wasn’t over. A real notice can’t report the result of something that hasn’t finished. This is the one tell anyone can catch — no expertise required.

✗

SIGN 2Sent from a school / government account, not Meta

HeaderFrom a hijacked .edu / .gov Google Workspace account — Meta sends from facebookmail.com / meta.com

In plain EnglishReal Meta mail comes from Meta’s own domains. This came from a hijacked school and government mailbox — academic and government accounts are farmed precisely because spam filters trust them.

✗

SIGN 3A five-year-stale headquarters address

Footer“1601 Willow Road, Menlo Park” — Facebook’s former HQ; Meta moved to 1 Meta Way in 2021

In plain EnglishThe footer used an address Meta abandoned in 2021. The kit was built from pre-rebrand material and recycled ever since — stale boilerplate dates the toolkit.

✗

SIGN 4It addressed a placeholder, not an account

Body“Recipient: [company] / Account Administrator” — no real Page name, no ad ID, no asset ID

In plain EnglishA genuine enforcement notice names your specific Page and a specific ad or asset ID. This cited only the company name — because that’s all the attacker had scraped.

✗

SIGN 5“Decisions are final”

Body“Requests are evaluated and decisions are final” — an appeal whose outcome is settled before it’s filed

In plain EnglishAn appeal that’s already decided isn’t a process — it’s a pressure device built to stop you thinking and get you clicking.

✗

SIGN 6Manufactured urgency

Body“Recommended response timeframe: within 24–48 hours”

In plain EnglishA countdown is the load-bearing element of the whole genre. Urgency is how a scam skips the part where you check.

✗

SIGN 7The whole thing exists to get one click

CTAA single “Submit Appeal” button — the payload; a link on throwaway infrastructure, not a Meta domain

In plain EnglishEvery line above exists to move you to one button. Hover it, and the destination isn’t Meta — it’s a disposable host. The link is the tell the copy is designed to make you skip.

All 7 signs are readable in the email itself — no tools required.

The body was genuinely well written and would pass a skim. That’s the point: the give-aways are in the metadata and the logic, never the prose. A forensic read looks where the copy is trying to keep your eyes away.

How the harvester was engineered

The landing page’s own JavaScript — read, never executed — showed a trap built to defeat the two things that would otherwise protect a victim: a second factor, and a password manager.

The fake password error. One password box captures your entry, shows a fabricated “incorrect password” message, then quietly asks again. Your second attempt is often the correct password, or a different real one. One fake error roughly doubles the yield.
The 2FA relay. Two-factor codes were requested four times, each on a 30-second lockout — the exact life of a TOTP code. That timer only makes sense if a person is spending each code in real time while the victim waits. A second factor does not protect you against a live relay.
Anti-password-manager. The password field was set readonly until clicked, specifically to stop a password manager from engaging. A manager refuses to autofill on the wrong domain — one of the best defenses a person has, and it works by staying silent. The kit was built so it never got the chance.
Exfiltrated on the first submit. Data uploaded on the first click, not at the end. Closing the tab retracts nothing — by then the first password is already gone.

Harvested per victim

full name · personal + business email · phone · Meta page name · password ×2 · 2FA code ×4

Hosting

Cloudflare Workers, free tier — deploys to any host unchanged

Exfiltration

Telegram bot (token recovered, reported, not published)

Payload status

live and unclassified by Safe Browsing 8 days after receipt

What the envelope established (and what it did not)

Established, from the headers: the sends were authenticated (not spoofed) through Google, from residential broadband that geolocates to Hanoi, Vietnam and to England, UK — both consistent with compromised home machines used as relays. The kit’s own source comments are written in Vietnamese, and one email (in French) left an untranslated Vietnamese fragment mid-sentence — three independent signals pointing at a Vietnamese-speaking operator.

Deliberately not asserted: a specific group, ring, or nation-state. Authenticated infrastructure can be compromised bystanders; a shared kit can be run by one crew or several unrelated buyers. We keep the proven column (compromised accounts, a live payload, the harvest mechanics, the geolocation) strictly separate from the inferred column (operator identity). That separation is what lets the findings survive scrutiny — and it is exactly what a federal complaint is built to correlate across other victims.

The method, so you can re-run it

None of this needed special access. It is a procedure any careful reader can reproduce on a suspicious message — and reproducibility is the point: a finding nobody can independently check is just an assertion.

Reproducible teardown procedure

Read the envelope, not the copy. Open the message’s raw headers (“Show original” in most mail clients). The Received: chain, SPF/DKIM/DMARC results, and origin IP tell you where it really came from.
Check what the sender proves vs. claims. A message can pass authentication and still be a lie — if it was sent from a hijacked account. Passing SPF/DKIM means the authority is real, not that the sender is who they say.
Never fetch the payload from its own host. Analyze a hostile page through a third party (a scanning service), or from its raw source — not from your own address, and never by executing its JavaScript. The precaution that keeps your IP out of the attacker’s logs also keeps a deployable kit off your disk.
Read the source; don’t run it. The exfiltration endpoint, the harvest fields, and the operator’s own comments live in plain text in the page. Reading them is analysis; using them is not.
Separate found from not-found from cannot-see. An empty result from a rate-limited lookup is blind, not clean. State what you measured and what you couldn’t — a null with no control is not a finding.
Hand it to the channel that can act. The deliverable is a documented teardown plus the indicators — for the platform’s abuse team, the host, and a federal complaint (IC3). Analysis produces the map; lawful process walks it.

What L0GIC does with a case like this

This case study is published because the work it shows — email and phishing-kit forensics — is exactly what we do. When an attack lands in your inbox, the useful question is rarely “who sent it” and always “what can be proven, and who can act on it.”

The deliverable is a documented teardown: the envelope forensics, the attack chain, the indicators of compromise (sending accounts, hosting, the exfiltration channel), and a calibrated statement of what is proven versus inferred — the package a platform abuse team, a host, or a federal complaint can act on. If you’ve received something like this and need it read properly, reach out to discuss it.

What we don’t do is guess. Attribution here stops exactly where the evidence stops — and everything an attacker didn’t hide is more than enough to act on.

Analyzed and published by L0GIC, August 2026. The attack targeted L0GIC’s own inbox and is published as a demonstration of email and phishing-kit forensics.
Compromised third-party accounts (a school and a government agency) are described by class and not named — they are victims, not the attacker. The exfiltration credential was recovered by reading public page source, never used, and reported to law enforcement; it is not published here. Any operator identity, where established, lives only in the law-enforcement file. This document does not constitute legal advice; consult licensed counsel for guidance specific to your situation.