AI brand impersonation targets meta business accounts via malicious apps

Campaign Overview

The Mimecast Threat Research team has been tracking a phishing campaign that exploits the popularity of AI platforms to distribute malicious mobile applications. This campaign impersonates trusted brands, specifically Google Gemini and OpenAI/ChatGPT to lure business users into downloading fraudulent apps from the Apple App Store.

The attack begins with phishing emails using subject lines such as "Google Gemini LLC has invited you to test Google Gemini Advertising" or "ChatGPT has invited you to test OpenAI Advertising." These messages present themselves as exclusive invitations to test new AI-powered advertising products, specifically targeting business owners and marketing professionals who manage social media advertising campaigns.

Attribution to Vietnamese Account Trading Operations

Mimecast has identified strong indicators connecting this campaign to Vietnamese threat actors specializing in Meta Business Manager account trade. The campaigns align with a broader trend of Vietnamese-based operations that acquire compromised Meta business accounts for resale or exploitation. The Vietnamese account trading ecosystem operates through several channels.

Underground Marketplaces: Compromised Meta Business Manager accounts with active payment methods command premium prices on Vietnamese-language forums and encrypted messaging channels. Accounts with established ad spend history and higher spending limits are particularly valuable.
For example, VIA17 is an openly accessible Vietnamese account marketplace that appears to commercialise social account access and related account-operation inventory. It is not just an isolated seller, but a representative storefront in a larger Vietnam-linked cybercrime service economy that supports downstream fraud operations, including Facebook ad-account abuse.

Ad Fraud Networks: Vietnamese threat actors utilize compromised accounts to run unauthorized advertising campaigns, often promoting fraudulent products or services while billing the legitimate account holder. This activity generates revenue while the compromised account absorbs the costs.

Account Farming Operations: Some actors specialize in accumulating large inventories of compromised accounts, which are then rented or sold to other threat actors for various malicious purposes including follow-on phishing campaigns, brand impersonation, and financial fraud. The choice to distribute malicious apps through legitimate channels like the Apple App Store represents a calculated evolution in tactics. By leveraging trusted distribution platforms, these threat actors significantly increase their success rate while appearing more credible to potential victims.