A Vietnamese threat actor is using Google AppSheet as a trusted relay to send phishing emails impersonating Meta Support, targeting Facebook Business account owners with lures about account disablement and copyright issues to harvest credentials, 2FA codes, and personal data. The campaign, codenamed AccountDumpling, has compromised approximately 30,000 accounts, with stolen data exfiltrated to Telegram channels and accounts sold on illicit marketplaces. This highlights the abuse of legitimate cloud platforms to bypass email security filters.
Threat Intelligence , Phishing Vietnamese operation uses Google AppSheet for Facebook phishing, targets 30,000 accounts May 1, 2026 Share By SC Staff (Photo by Kirill Kudryavtsev/AFP via Getty Images) As detailed in The Hacker News, a sophisticated phishing operation linked to Vietnamese threat actors has been discovered leveraging Google AppSheet as a relay to distribute malicious emails aimed at compromising Facebook accounts. This operation, codenamed AccountDumpling by Guardio, has reportedly led to the hacking of approximately 30,000 Facebook accounts. The AccountDumpling campaign targets Facebook Business account owners with emails impersonating Meta Support, creating a false sense of urgency to prompt users to click on links leading to fake credential harvesting pages. These phishing emails are sent from a legitimate Google AppSheet address, allowing them to bypass spam filters. The operation employs various lures, including account disablement, copyright complaints, and fake job offers, to trick victims. Data collected includes credentials, two-factor authentication codes, personal information, and government ID photos, often exfiltrated to Telegram channels. Evidence, including metadata from generated PDFs, points to a Vietnamese individual named PHẠM TÀI TÂN as being behind the operation. The stolen accounts are then sold on illicit marketplaces, highlighting a growing trend of trusted platforms being repurposed for malicious activities and the commercialization of compromised digital assets. Source: The Hacker News SC Staff Related Security Operations Ubuntu and Canonical services disrupted by DDoS attack claimed by hacktivists SC Staff May 1, 2026 Hacktivists identifying as The Islamic Cyber Resistance in Iraq 313 Team have claimed responsibility for the ongoing DDoS attack, reportedly utilizing a DDoS-for-hire service named Beamed. Threat Intelligence FBI: Cyber-enabled cargo theft losses spike SC Staff May 1, 2026 Intensified cyber-enabled cargo heists have prompted nearly $725 million in losses in the U.S. and Canada last year, which is a 60% increase from 2024, reports The Record, a news site by cybersecurity firm Recorded Future. Vulnerability Management Decade-old vulnerabilities continue to fuel millions of cyberattacks in the UK SC Staff May 1, 2026 Cybercriminals are leveraging outdated and unpatched systems, with a single vulnerability in Hikvision IP cameras reportedly accounting for 67 million attack attempts in the UK during 2025, according to SonicWall. Related Events Cybercast Better Threat Intelligence Between Public and Private Sectors On-Demand Event Virtual Conference Nationwide Cybersecurity Summit 2025: Safeguarding America’s Digital Future On-Demand Event Virtual Conference Securing the Future of Finance: Strategies to Counter Modern Cyber Threats On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Account Harvesting Business Email Compromise (BEC) Deauthentication Attack Dictionary Attack Distributed Scans Domain Hijacking Fault Line Attacks Google Hacking Hybrid Attack Reconnaissance You can skip this ad in 5 seconds