Facebook sues hackers who hijacked advertising agencies' accounts

Facebook has filed lawsuits against two groups of suspects who took over advertising agency employees' accounts and abused its ad platform to run unauthorized or deceptive ads.

The social network says that four Vietnamese nationals (Thêm Hữu Nguyễn, Lê Khang, Nguyễn Quốc Bảo, and Pham Hữu Dung) took over the Facebook accounts of multiple employees working at marketing and advertising agencies using a technique known as session theft (aka cookie theft).

Their victims' Facebook login credentials were stolen using a malicious Android app named "Ad Manager for Facebook" created by the defendants and no longer available on the Google Play Store.

The app prompted the targets to enter their credentials and other sensitive information, later used by the suspects to take over their accounts and run over $36 million worth of Facebook ads without authorization.

Facebook refunded and helped the victims secure their accounts and is seeking to hold the attackers "accountable for creating the app, tricking people into installing it, compromising people's Facebook accounts and then using those accounts to run deceptive ads."

The company also sued California marketing company N&J USA Incorporated and its agents for running a bait-and-switch advertising scheme on Facebook's ad platform.

"When someone clicked on one of these ads, they were redirected to third-party e-commerce websites to complete their purchase," said Jessica Romero, Director of Platform Enforcement and Litigation.

"After paying for an item, users either never received anything or received merchandise that was different or of a lesser quality than what had been advertised."

Facebook fights platform abusers in court

This is the second time the social network giant has sued ad platform abusers for orchestrating account takeover attacks targeting Facebook accounts.

In 2019, Facebook sued one entity and two individuals for tricking its users into installing malware via Facebook ads.

The malware was designed to help the attackers take over targets' Facebook accounts for running ads promoting counterfeit goods and diet pills.

These legal actions are part of a long series of instances where Facebook sued individuals and entities who abused the company's platforms and services.

Notably, in March 2020, Facebook sued domain name registrar Namecheap and its Whoisguard proxy service "for registering domain names that aim to deceive people by pretending to be affiliated with Facebook apps," frequently being used "for phishing, fraud and scams."

In October 2019, Facebook filed another lawsuit against domain name registrar OnlineNIC and its ID Shield privacy service for allowing the registration of lookalike domains used in malicious campaigns.

The same month, Facebook also sued Israeli cyber-surveillance firm NSO Group and Q Cyber Technologies, its parent company, for creating and selling a WhatsApp zero-day exploit used to attack high-profile targets, including government officials, diplomats, and journalists.