En bref
Attacker DMs creators posing as Meta Verified support: 'we detected suspicious activity, click link to verify or your account will be deleted'. Phish page asks login + 2FA TOTP code (relay attack). Often hits influencers, small businesses,...
Comment ca fonctionne
Attacker DMs creators posing as Meta Verified support: 'we detected suspicious activity, click link to verify or your account will be deleted'. Phish page asks login + 2FA TOTP code (relay attack). Often hits influencers, small businesses,...
Signaux d'alerte
- Pression urgente pour cliquer, payer ou partager des codes immediatement.
- Lien ou expediteur qui ne correspond pas a l'organisation officielle.
- Demande de carte, mot de passe, OTP, signature wallet ou virement.
Que faire
- 1Attacker DMs creators posing as Meta Verified support: 'we detected suspicious activity, click link to verify or your account will be deleted'.
- 2Tells: 1) DM comes from non verified Meta lookalike (no blue check); 2) urgency + threat of deletion; 3) link is meta verify help.com etc (typo squat); 4) site asks 2FA code immediately after login (real Instagram doesn't on familiar device).
- 3DO: only manage account via the official Instagram app; report DMs as phishing; enable hardware key 2FA.
Source
Meta-Adversarial-Threat-Report
Source verifiee par Mythos Forensic Team
https://about.fb.com/news/category/security/FAQ
Instagram 'fan support' / verification phish hijacking creator accounts est une vraie arnaque ?
Oui. Traitez le message, l'appel ou la demande de paiement comme suspect jusqu'a verification via un canal officiel.
Quels sont les premiers signaux ?
Pression urgente pour cliquer, payer ou partager des codes immediatement.; Lien ou expediteur qui ne correspond pas a l'organisation officielle.; Demande de carte, mot de passe, OTP, signature wallet ou virement.
Que faire en premier ?
Attacker DMs creators posing as Meta Verified support: 'we detected suspicious activity, click link to verify or your account will be deleted'.; Tells: 1) DM comes from non verified Meta lookalike (no blue check); 2) urgency + threat of deletion; 3) link is meta verify help.com etc (typo squat); 4) site asks 2FA code immediately after login (real Instagram doesn't on familiar device).; DO: only manage account via the official Instagram app; report DMs as phishing; enable hardware key 2FA.
LegalAudit peut-il verifier mon cas ?
Oui. Lancez le chat gratuit et collez le message, le lien, l'expediteur ou les details de paiement.