{"id":57391,"date":"2025-09-07T09:29:57","date_gmt":"2025-09-07T06:29:57","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=57391"},"modified":"2026-03-28T08:15:53","modified_gmt":"2026-03-28T05:15:53","slug":"kaspersky-warns-of-a-new-credential-stealing-campaign-via-facebook","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-warns-of-a-new-credential-stealing-campaign-via-facebook\/","title":{"rendered":"Kaspersky warns of a new credential-stealing campaign via Facebook"},"content":{"rendered":"\n

September 7, 2025<\/p>\n\n\n\n

Since late August 2025, the Kaspersky Global Research and Analysis Team (GReAT) has been observing a new malicious campaign leveraging a stealer \u2014 a type of malware designed to steal passwords and other account information. The StealC v2 infostealer is likely being spread through Facebook messages. More than 400 incidents have been identified to date, targeting users across multiple countries, including confirmed cases in Jordan, Yemen, Qatar, and Lebanon.<\/strong><\/p>\n\n\n\n

Facebook users receive messages likely containing a link disguised as a notification that their account has been blocked as part of this attack.<\/p>\n\n\n\n

\"Kaspersky<\/a><\/figure>\n\n\n\n

An example of a phishing message disguised as an account block notification<\/em><\/p>\n\n\n\n

Clicking the link opens a fake support page claiming that the user\u2019s account has been blocked due to suspicious activity. To \u201crestore access,\u201d users are prompted to use the \u201cAppeal\u201d button, which initiates the download of a malicious script that installs the StealC v2, a dangerous malware offered under a Malware-as-a-Service model, on the victim\u2019s device. The malware itself steals passwords, cookies, screenshots, as well as cryptocurrency wallet data.<\/p>\n\n\n\n

\"Kaspersky<\/a><\/figure>\n\n\n\n

A phishing message with a button that downloads the info-stealer when clicked<\/em><\/p>\n\n\n\n

\u201cCybercriminals often exploit users\u2019 fear of losing account access and a perceived sense of urgency. This pressure can lead individuals to act without caution, increasing the risk of infection by malware such as StealC v2. Users should remain vigilant and always verify the authenticity of messages before clicking any links,\u201d comments Marc Rivero, lead security researcher at Kaspersky’s Global Research and Analysis Team. <\/p>\n\n\n\n

StealC v2, first observed in 2025, significantly enhances the malware\u2019s capabilities and elevates the risk to both individual and corporate users. The original StealC, which emerged in 2023 on dark web platforms, quickly became a sought-after tool among cybercriminals thanks to its accessibility, capabilities and ease of access.<\/p>\n\n\n\n

To be protected from phishing, Kaspersky recommends corporate and individual users:<\/p>\n\n\n\n