Personalized Facebook Marketplace Phishing Lures Victims with Their Own Name and Phone Number
What Happened — Attackers craft fake Facebook Marketplace listings that display the recipient’s own name and phone number, sending the lure via iMessage. The personalized screenshot prompts the target to reply, confirming the phone number is active and valuable to the attacker.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a documented security‑awareness program that can detect and report socially engineered messages.
- Highlights the importance of continuous monitoring of user‑reported phishing incidents as evidence of due diligence.
- Shows that control objectives around identity verification and communication policies must be auditable and repeatable.
Who Is Affected
- General consumers using Facebook Marketplace (media/entertainment sector).
- Any organization whose employees use personal devices for work‑related communications.
Recommended Actions
- Deploy or refresh security‑awareness training that includes personalized phishing scenarios.
- Enforce a policy to verify unsolicited messages through an independent channel before responding.
- Limit publicly shared personal information on social platforms to reduce data available for lure creation.
- Implement a phishing‑reporting workflow and retain evidence for audit readiness. Source: Malwarebytes Labs
Technical Notes
- Attack vector: SMiShing (phishing via SMS/iMessage) using a “conversation lure” that mimics a legitimate Marketplace listing.
- No specific CVE; the technique leverages publicly available personal data from prior breaches sold on dark‑web forums. Source: Malwarebytes Labs