{"id":236340,"date":"2026-05-01T22:25:37","date_gmt":"2026-05-02T03:25:37","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/05\/30000-facebook-accounts-hacked-via-google-appsheet-phishing-campaign"},"modified":"2026-05-01T22:25:37","modified_gmt":"2026-05-02T03:25:37","slug":"30000-facebook-accounts-hacked-via-google-appsheet-phishing-campaign","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/05\/30000-facebook-accounts-hacked-via-google-appsheet-phishing-campaign","title":{"rendered":"30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/30000-facebook-accounts-hacked-via-google-appsheet-phishing-campaign2.jpg\"><\/a><\/p>\n<p>A newly discovered Vietnamese-linked operation has been observed using a Google AppSheet as a \u201cphishing relay\u201d to distribute phishing emails with an aim to compromise Facebook accounts.<\/p>\n<p>The activity has been codenamed <strong>AccountDumpling<\/strong> by Guardio, with the scheme selling the stolen accounts back through an illicit storefront run by the threat actors. In all, roughly 30,000 Facebook accounts are estimated to have been hacked as part of the campaign.<\/p>\n<p>\u201cWhat we found wasn\u2019t a single phishing kit,\u201d security researcher Shaked Chen <a href=\"https:\/\/guard.io\/labs\/accountdumpling---hunting-down-the-google-sent-phishing-wave-compromising-30-000-facebook-accounts\">wrote<\/a> in a report shared with The Hacker News. \u201cIt was a living operation with real-time operator panels, advanced evasion, continuous evolution and a criminal-commercial loop that quietly feeds on the same accounts it helps steal back.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A newly discovered Vietnamese-linked operation has been observed using a Google AppSheet as a \u201cphishing relay\u201d to distribute phishing emails with an aim to compromise Facebook accounts. The activity has been codenamed AccountDumpling by Guardio, with the scheme selling the stolen accounts back through an illicit storefront run by the threat actors. In all, roughly [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,385],"tags":[],"class_list":["post-236340","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-evolution"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/236340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=236340"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/236340\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=236340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=236340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=236340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}