30,000 Facebook accounts hacked in April 2026 phishing campaign using Google AppSheet emails targeting business users.
A large-scale phishing campaign has compromised around 30,000 Facebook accounts after attackers abused a legitimate Google service to bypass security protections.
The operation, uncovered on May 1, 2026, has been linked to Vietnamese threat actors and was identified by security researchers at Guardio. The campaign, dubbed “AccountDumpling,” used Google AppSheet as a phishing relay to send malicious emails that appeared trustworthy to recipients.
According to researchers, the attackers primarily targeted Facebook Business account owners by impersonating Meta Support. Victims were warned their accounts could be suspended or deleted unless they submitted an urgent appeal, prompting them to click phishing links.
The emails were sent from legitimate AppSheet addresses, such as “noreply@appsheet.com,” allowing them to bypass spam filters and increase credibility. Once victims followed the links, they were redirected to fake login pages designed to harvest credentials.
Security analysts said the campaign was highly sophisticated, featuring real-time control panels, evolving phishing infrastructure, and a monetization system where stolen accounts were resold through underground marketplaces.
Researchers warned that the operation highlights a growing trend of cyber-criminals abusing legitimate cloud services to evade detection and scale attacks. The use of trusted platforms like Google’s AppSheet makes phishing attempts harder to identify and block, increasing risks for businesses relying on social media accounts for operations.
The campaign remains active, and experts urge users to remain cautious of unsolicited emails requesting urgent account action, even if they appear to come from legitimate services.
Related articles :
- First Malicious Outlook Add-In Steals 4,000+ Credentials
- APT37 Uses Facebook to Deploy Malware in New Campaign
- Hackers Use LinkedIn Messages to Spread RAT Malware
Reports are sourced from official documents, law-enforcement updates, and credible investigations.
Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.
