Scammers impersonated Meta through paid for Facebook adverts which contained links to malware.
As TechCrunch initially reported, the ads (which were convincing at first glance) were initially spotted by social consultant Matt Navarra who tweeted: “How did this ad get approved @Meta ? Verified account impersonating Meta tricking users into downloading shady tools.”
One of the ads, posted by a verified page with tens of thousands of followers called Meta Ads, tried to trick users into downloading a “more professional and secure” ad-management tool because “security issues” had meant users could no longer manage ad accounts in-browser.
The ad included a link to a malware infected website, and was promoted on Facebook as a paid-for sponsored ad.
A different verified page pretended to be Google AI, and pointed to fake links for Bard, the tech giant’s new AI platform.
As TechCrunch notes, prior to being hacked, the page belonged to a popular Indian singer and actress called Miss Pooja and had more than 7 million followers before the account and page name changed on April 29.
All of the hacked pages identified by Navarra have reportedly since been disabled, though its worth noting that the hackers had managed to get their ads approved without issue in Meta’s automated ads system before they were spotted and taken down.
Meta did not immediately respond to PCMag’s request for comment, but a company spokesperson told TechCrunch: “We invest significant resources into detecting and preventing scams and hacks. While many of the improvements we’ve made are difficult to see - because they minimize people from having issues in the first place - scammers are always trying to get around our security measures.”
In a bid to improve account protection and protect Facebook users against scammers, Meta recently launched a verification program titled Meta Verified. For the privilege of better customer support and “proactive account protection”, Instagram and Facebook users will have to pay a minimum of $11.99 a month.