30,000 Facebook Accounts Hacked: The AccountDumpling Scam Abused Google AppSheet

A large phishing campaign let cybercriminals take over about 30,000 Facebook accounts in more than 50 countries. The operation, named AccountDumpling, was uncovered by researchers at Guardio Labs, then reported by Malwarebytes. Its main ingredient? A legitimate Google tool, hijacked to send fraudulent emails that could slip past spam filters.

This article will also interest you: Facebook: how to get your password hacked in 5 methods

A scam that trades on trust in Google

It starts with an alarming email. The message warns the victim that their Facebook account has been reported for breaking the platform's rules. It claims the account will be permanently suspended within 24 hours if they do not respond.

The detail that changes everything: the message appears to come from a Google-related address. The attackers abused Google AppSheet, an official service for building apps without programming skills. AppSheet has a notification system that can send email from noreply@appsheet.com, through Google's servers.

The result: for many spam filters, these messages look like trusted communications. Mailbox security checks therefore let them through much more easily.

Fake Facebook pages built to steal more than a password

The email invites the victim to click a link. After the click, they land on a page that imitates the Facebook Help Center. That fraudulent page is hosted on Netlify, a legitimate web hosting platform, which makes the illusion even stronger.

The fake page then asks for Facebook credentials, including the password. The attackers do not stop there: they also ask for the date of birth, the phone number, and photos of an identity card. With that information, they can take full control of the account and lock out the real owner.

Other variants of the scam rely on:

• the blue verification badge;
• rewards for advertisers;
• a supposed chance to get an account verified;
• fake pages able to capture up to three two-factor authentication codes;
• PDFs hosted on Google Drive, imitating an official Meta notification, with a logo and a polished layout.

Those PDFs contain a button or a link leading to a real-time control panel, designed to intercept the password and the two-factor authentication code.

A metadata mistake gives the attacker away

Researchers managed to trace the operation back to its alleged operator. He made a mistake: he did not remove the metadata from the PDF used in the scam.

Analysis of that data shows the document was created on Canva by a person named Phạm Tài Tân. Investigators then found him on Facebook and on his official website. A troubling detail: this man would also offer “Facebook account recovery help” services.

The attack infrastructure relies on Telegram bots that collect the stolen data in real time, sort it, and pass it to the attackers. By cross-checking four identified bots, Guardio Labs estimates about 30,000 victims, spread across more than 50 countries. Nearly 68.6% of them would be in the United States.

A real criminal supply chain

The investigation describes a well-oiled organization: a creator of phishing kits, an attacker in charge of launching the campaigns, and a platform dedicated to reselling the stolen accounts. Those accounts can then be sold on black markets, used to run fraudulent ads, or turned to identity theft.

Several victims contacted by Guardio Labs reported fraudulent bank transactions. Proof that a simple Facebook account theft can lead to much more serious consequences.

Guardio Labs compares this machinery to a criminal supply chain: access is collected, accounts are hijacked, then recovery itself is sold. Each step feeds the next.

How to recognize and avoid this Facebook scam

Against this kind of campaign, caution remains the best defense. These are the reflexes to adopt:

• Do not click any link in an urgent email about your Facebook account.
• Remember that Facebook does not contact you from a Google address.
• Go directly to the official Facebook website or app to check your notifications.
• Be wary of a form that asks at the same time for your password, several authentication codes, and an identity document.
• Turn on Facebook login alerts.
• Replace SMS authentication with a dedicated two-factor app, such as Google Authenticator.
• Do not download PDFs attached to messages that claim to come from Meta.
• Always check the URL before entering any information.

FAQ: common questions about the AccountDumpling scam

What is the AccountDumpling operation?

It is a large phishing campaign discovered by Guardio Labs. It stole about 30,000 Facebook accounts around the world.

Did the fraudulent emails really come from Google?

They were sent through Google AppSheet, an official Google tool. The attackers hijacked its notification system to send messages from a Google-related address.

How many victims are affected?

About 30,000 accounts, in more than 50 countries. Nearly 68.6% of the victims would be in the United States.

What should I do if I clicked a suspicious link?

Change your Facebook password immediately, log out of every active session, turn on two-factor authentication with an app, check your bank accounts, and report the incident to Facebook.

How can I protect my Facebook account effectively?

Use a unique, complex password, turn on login alerts, and prefer an authenticator app over SMS.

Key takeaways

• About 30,000 Facebook accounts were reportedly hacked through the AccountDumpling operation.
• The attackers hijacked Google AppSheet to send credible emails.
• Pages imitating Facebook and booby-trapped PDFs were used to steal credentials, identity documents, and 2FA codes.
• A metadata mistake made it possible to identify a suspect, Phạm Tài Tân.
• The best protection is still vigilance: never click an urgent link received by email, and always go through the official Facebook app or website.