Social Media Phishing
Phishing
Social media phishing uses platforms like Facebook, Instagram, LinkedIn, Twitter, and TikTok to deliver phishing attacks through direct messages, fake profiles, malicious posts, and fraudulent advertisements. Attackers exploit the inherently social and trust-based nature of these platforms to distribute malicious links, conduct social engineering, and harvest credentials from users who feel safe within familiar social environments.
Common social media phishing tactics include creating fake brand support accounts that intercept customer complaints, sending connection requests from impersonated executives to extract information, posting fraudulent giveaway campaigns that require login credentials, and placing targeted ads that direct users to phishing sites. The rich profile data available on social platforms enables highly targeted attacks, as attackers can craft personalized lures based on a victim's interests, employer, connections, and recent activity.
The scale of social media phishing has grown enormously as these platforms have become central to both personal communication and business operations. Attackers target not only individual users but also business accounts, using compromised pages and profiles to distribute phishing content to the brand's followers. The speed at which content spreads on social media means that a single compromised account can expose thousands of people to phishing within minutes.
Common social media phishing tactics include creating fake brand support accounts that intercept customer complaints, sending connection requests from impersonated executives to extract information, posting fraudulent giveaway campaigns that require login credentials, and placing targeted ads that direct users to phishing sites. The rich profile data available on social platforms enables highly targeted attacks, as attackers can craft personalized lures based on a victim's interests, employer, connections, and recent activity.
The scale of social media phishing has grown enormously as these platforms have become central to both personal communication and business operations. Attackers target not only individual users but also business accounts, using compromised pages and profiles to distribute phishing content to the brand's followers. The speed at which content spreads on social media means that a single compromised account can expose thousands of people to phishing within minutes.
Key Statistics
- Proofpoint reports that social media phishing attacks increased by 75% in 2022 compared to the prior year.
- LinkedIn phishing messages have a 47% open rate, significantly higher than email phishing.
- Over 500 million social media accounts are estimated to be fake, many created for phishing and social engineering.
- The FTC reported that social media was the top contact method for fraud in 2022, with $770 million in reported losses.
Prevention Strategies
- Verify the authenticity of social media accounts before engaging, checking for verified badges, account age, and post history.
- Never click links in unsolicited social media messages, especially those claiming to be from brands or support teams.
- Enable two-factor authentication on all social media accounts and use unique passwords for each platform.
- Report and block fake accounts impersonating your brand immediately, and work with platform trust and safety teams on takedowns.
- Monitor social media platforms for unauthorized use of your brand name, logos, and content in profiles and advertisements.
How Beacky Helps
When attackers create fake social media landing pages or clone your website to use in social media phishing campaigns, Beacky's embedded beacons detect the unauthorized content usage. This detection extends to any web-based destination linked from social media, providing visibility into phishing operations that originate on social platforms but ultimately direct victims to cloned web content.