Full transcript
0:00I have been getting a handful of fishing
0:02emails from Facebook. Literally, it is
0:04from Facebook, right? You can see this
0:06is no-reply@facebookmail.com,
0:09business.facebook.com.
0:11It's legitimately Facebook. You can see
0:13the subject line here, "Hey, you've
0:14received a Business Manager Partner
0:16Request." And this is an official email
0:19sent from Facebook, even with a button
0:22to view the request pointing to
0:25business.facebook.com.
0:27But, here's the clever trick here. You
0:28might have actually seen it. "Your
0:30account will be locked in 24 hours.
0:32Reason is not part of or affiliated with
0:35Meta." Usual boilerplate
0:38for, okay, like an unverified account.
0:41So, you see the gimmick is that this,
0:43"Your account will be locked in 24
0:45hours. Reason." That string is the
0:49business name as something that is doing
0:51this outreach and triggering this
0:53notification to land in your inbox. That
0:55is a hacker's, threat actor's name of a
0:58business just so they can fits in the
1:00email template and looks like it's real.
1:03Looks like urgency. They even say, "The
1:06request is from" all this being genuine
1:08boilerplate from the Facebook email
1:11here. But, they name their account, the
1:13individual, the person, the business
1:15manager from their business, big air
1:18quotes here, "Urgent appeal within 24
1:21hours." And they include not Facebook
1:24but actual fishing website URL and link
1:28in their name so that it funnels down
1:30into this email. Now, I received this on
1:33April 14th, about a week ago. And then I
1:35received one on April 19th and one on
1:39Monday, just a bit ago. Different name
1:41for the business here. And of course, a
1:43different URL or different link. This
1:45was another more recent one here. And in
1:48between that time period, I received
1:51like seven more of them. This one's
1:53really funny. I don't know if they just
1:54forgot to put the URL for the fish in
1:56there, but Nubwo 5A I I don't know if
1:59that's a threat actor docs, but all of
2:01these came with different URLs. sign
2:04up.agency-partner.community.com
2:07members.subdomain
2:09another here for shield x
2:11marketing-partner-join.com
2:14support 93 and a lot of these are coming
2:16with like a support and then number
2:18following it. So very clearly blasting
2:21out campaign and I appreciate Google
2:23jumping in. You know what? This is a
2:25fish. Gmail and Google workspace
2:27actually straight-up said they sent me a
2:29little alert email notification that was
2:30like sorry, we detected this post
2:33delivery after it already landed in your
2:35inbox, but yeah, here's a fishing email
2:36from Facebook. Back to our flurry of
2:40fish though. A lot of these are
2:42obviously down, right? It has been just
2:44a smidge of time. So
2:46pages.agency-partner-programs.com
2:50is currently offline. Same with
2:52agency-partner-invoice.com
2:55and all these support number sub
2:57domains. Yo, we had a lot of the support
3:0058 support 72 support 122 84. That list
3:06goes on and on and on. What about our
3:08shield x? Nope, he's dead too. So one of
3:11the more recent ones is at least online
3:13and we can dig into it see what we have
3:15to play with here. We do already see
3:17though that CloudFlare is up and action
3:19here. I think this is Vercel that's
3:21actually the thing hosting it. I am
3:22connecting over tour the onion router so
3:25have a different IP address each time
3:26just with brave cuz that keeps it nice
3:28and easy, but I think that's a Vercel
3:30icon over in the top right, right? And
3:32we could go to like anything like an
3:34endpoint that does not exist. Let me try
3:36anything does not exist and that's a 404
3:41page not found. Looks a lot like Vercel,
3:43but ultimately that points us to this
3:45being their next.js like JavaScript
3:47framework thing. Cuz if we were to get
3:49back to the real website here, say we
3:50were to fall for this fish or just kind
3:53of taking a look, see what we have here.
3:55Let's ignore and proceed just to see
3:56what this page is and does. Ooh, little
3:59flashy Facebook meta animation. And
4:02then, we're at the Meta Agency Partner
4:05Program. Little ticket ID to look
4:08official, and I am super duper zoomed
4:10in. You would be able to see some
4:11navigation on the left-hand side here.
4:12But, let's do a round of the old sniff
4:15test for a fish, shall we? Privacy
4:16Center home, search buttons,
4:20any of the other pages don't really do
4:22anything. They're They're not links.
4:24They don't go anywhere. So, we're taking
4:26a couple points off for that, shady
4:28hackers. Couple buttons here to join the
4:30Meta Agency Program. Ooh, a little bit
4:32of urgency when we click this thing, at
4:33least probably calculating the date and
4:35time. But, all these collapse and expand
4:38little details,
4:39nothing. Nothing happens. The privacy
4:42policy points back to itself as a page.
4:45You load the animation again. So, like,
4:47F F grade on this thing, D minus. But,
4:51let's see what it does, shall we? Let's
4:52fire up our Join Meta Agency Program.
4:56And this is where it asks for all the
4:57things that it wants to steal from you
4:59and that you provide it themselves. So,
5:01let's fill that in with the classic,
5:03spam the number one. Now, we're going to
5:05peel back the code and go a little bit
5:06further. But, real quick, while we're
5:08chatting about phishing emails and trust
5:11and who to trust, let me take a quick
5:12second to tell you about the sponsor of
5:14today's video, Vanta. Risk and
5:16regulations really are ramping up, and
5:19customers expect proof of security in
5:21order to do business. Vanta knows that's
5:23a must-have requirement. So, they
5:25synthesize compliance, risk, and
5:27customer trust all into one a
5:29streamlined solution. They automate your
5:32compliance process with an AI-powered
5:34platform. So, whether you're prepping
5:36for SOC 2 or maintaining your GRC
5:38program, Vanta handles the hard work for
5:41you. So, you can keep your business
5:43moving. Because even in the age of AI,
5:46security is still hard. It's harder than
5:48it's ever been before, and trust can
5:51make or break your business. You and
5:53your security team, alongside other
5:55security leaders, are juggling
5:57everything. Protecting your entire
5:59organization, not to mention customer
6:01data. But while the industry is moving
6:03too fast, you still got to keep up.
6:06Vanta helps streamline and safeguard
6:08your security program. Companies like
6:11Ramp and Ryder spend 82% less time on
6:14audits with Vanta. They're trusted by
6:16tens of thousands of companies to unify
6:18risk, compliance, and trust. In fact,
6:21they're the number one rated GRC product
6:23on G2 reviews, a leader in the IDC
6:26market space, and they've been
6:27recognized by Fast Company and Forbes
6:29for innovation. The Vanta Agentic Trust
6:32Platform plugs into your existing
6:34infrastructure, so you have a
6:36continuous, single source of truth. It
6:39flags the issues that actually need
6:40attention, and automates everything
6:42else, so you aren't bogged down. That's
6:45Vanta. A solution to enable your trusted
6:47security program. Don't get stuck trying
6:50to prove it. Get out from under it and
6:52stay on top of it. Vanta helps clear
6:54your path so you can grow confidently
6:56and stay ready for anything. You can get
6:58started with Vanta with my link below in
7:00the video description. jh.live/vanta.
7:04Huge thanks to Vanta for sponsoring this
7:06video.
7:08And this is where it asks for all the
7:09things that it wants to steal from you
7:11and that you provided themselves. So,
7:13let's fill that in with the classic spam
7:15the number one. Same thing with the
7:17email, you know, why not? We don't even
7:18need to add an email address at sign in
7:20there. It could just be crap. Doing the
7:22same thing for my date of birth, and
7:24really does not matter. You see, we're
7:26just kind of stress testing this to see
7:28what happens. The terms of use link
7:31isn't a link. This toggle works, but
7:33it's not going to bring anything. It
7:34just kind of clicks into the check box.
7:36So, we'll send this and it needs to ask
7:38for our password. Of course, it wants to
7:40steal or exfiltrate our password. So,
7:42again, we'll just spam a bunch of number
7:45nine, I guess. But, the password I've
7:47entered is incorrect. Correct.
7:49Let's do it again.
7:51Uh funny thing here, it will force ask
7:53you for a second password, and then
7:55whether or not that's right or wrong,
7:58and thank you would added the number one
7:59for my user. That's really funny. It
8:01will ask you for two-factor
8:03authentication. I don't know if or how
8:05this is supposed to actually happen, cuz
8:07obviously there wasn't a whole lot of
8:08email verification. I didn't even
8:09include like an @ sign or dot com domain
8:12there. Authentication app, maybe like
8:14Duo or Authenticator, Google
8:16Authenticator. Again, let me just spam
8:18nonsense in there, and then it says,
8:20"Hey, you know what? That's not right.
8:22Why don't you wait 30 seconds?" Really
8:24really struggling. However, we can give
8:26them points for this, right? Because a
8:28victim might be duped thinking, "Hey,
8:30what the heck?" And they're strung along
8:32wanting to like solve this problem or
8:34get this email out of the way faster,
8:36and now they're like, "Okay, sure. I got
8:38to finish this thing and then enter it
8:39once again." But, I literally can't type
8:41on this until the 30-second calendar is
8:43over, and then we can spam more
8:44nonsense. I hit continue, but then we
8:46might just be stuck in this loop. All
8:48right, let's do our third time. Third
8:49time's the charm, three strikes you're
8:51out kind of thing. Oh, request has been
8:53sent.
8:54Yeah, you sure? You positive? Really?
8:56So, crappy phishing website, but kind of
8:59clever and crafty phishing email,
9:02literally templating in the names of
9:04their business or their accounts to be
9:06used in a legitimate real email sent
9:09from legitimate real Facebook. Okay, so
9:11let's change our perspective here.
9:13Rather than falling down the rabbit
9:15hole, being a victim, play pretend
9:17falling for the fish, let's go take a
9:19look at how this thing is made up. We
9:21have a different ticket ID every time,
9:23so we're going to assume a little bit of
9:24client-side like JavaScript code making
9:26things a little bit flexible for us.
9:28But, is this some stupid dumbo phishing
9:30kit off the shelf or it just like hard
9:32codes a Telegram URL or some bot API
9:35that it just funnels all your info to?
9:37Let me view the source on this webpage
9:39and it is all kind of minified on one
9:41line, so let's try to pull all of that
9:43out. Let me paste it into a text editor,
9:45Sublime Text here, and there's not going
9:47to be a whole lot for us to be able to
9:48see for like the static HTML that was
9:51returned. The live dynamic JavaScript is
9:54probably what we're more interested in
9:56and I just use a little plugin like HTML
9:57beautifier prettify to make that easy.
10:00But we can see our Meta Business Help
10:01Center. This is all a bit more easy to
10:03read, but nothing too fancy here. We do
10:05see indicators of the next JS
10:07capability, but a lot of webpack. And if
10:11folks aren't familiar, webpack is one of
10:13those ways to bundle up a whole lot of
10:15like JavaScript code or your front-end
10:19app into hey, something that's a little
10:21bit more readily available from caching,
10:23loading, presenting it to you. I think.
10:25Is that a fair
10:27Someone let me know in the comments if
10:28that's a fine way to capture webpack in
10:30like 2 seconds. The thing is, we're not
10:32going to see a lot of that unless we
10:34were to open up the live like developer
10:36tools. Pressing F12 on our keyboard,
10:38little bit of Missouri hacking. And this
10:40is the funniest thing.
10:42I don't know if you can see it. Error
10:43notifying Telegram about the visit
10:46inside of our console or developer
10:48browser tools console, it immediately
10:50throws this error at us. So, we're
10:52taking points off for the fish. This is
10:54the worst. But see how this actually
10:56ties to a 117-aa517
11:00blah blah blah.js JavaScript file. If we
11:04click into it and go into the sources
11:05here, we could use this as kind of well,
11:07a debugger to get an understanding of
11:09what JavaScript files are included here.
11:12Like, take a look, the contact very
11:14agency partner management is the one URL
11:17that I've been experimenting with for
11:18this. That's another one that's live,
11:20but it's inside of the next JS chunks
11:22and apps. You can see all of these
11:25different .js files. Now, there isn't a
11:28.map suffix that would would of make
11:30this a little bit easier to manage and
11:31make sense of, but because they're
11:33chunked up into these different parts
11:35and pieces for webpack, you can see at
11:38the very, very top here, this is going
11:40to be a little bit gross. I don't really
11:43want to read all this. I don't like
11:45JavaScript. I don't think you like
11:46JavaScript. Everyone that says so is
11:48kind of just playing pretend or on a
11:50different planet, and I mean that
11:51jokingly as, you know, like different
11:53industries, different jobs, front-end
11:54software engineer stuff. But we could
11:56literally see or track down where they
11:58mention Telegram. Not in this file, not
12:01in this file, not in this file. Oh, we
12:04got it, actually. Error notifying
12:06Telegram about the visit. Okay, so we're
12:09probably pretty close on our hunch that
12:11this is some stupid dumbo just push
12:14stolen access over to Telegram, but it's
12:16at least putting it something
12:19server-side. Like there's not a
12:20hard-coded https bot token, etc. Naked
12:24invisible in front-facing JavaScript,
12:29but probably something a little bit more
12:31on their back-end, like the server-side,
12:33to be able to make the code and call
12:35these requests out from their own API,
12:37like /api/clientextend.
12:40And of course, they're probably going to
12:41be stealing like your IP address,
12:43everything that they could get from
12:44apiip.cc.
12:46But if we saw our error on error
12:48notifying Telegram about the visit just
12:50as we loaded the page, would we be able
12:52to see not hitting API/notification,
12:55but maybe API-clientextend?
12:58Let's try to go through the process as
13:00if we were to fall for this fish with
13:02the network tab open, and we can see
13:04what it tries to hit. So let's go
13:06through this form again. Looks like
13:08there's some communication to ah,
13:11apiip.cc.json.
13:13What did that get? Aha, of course, the
13:15victim IP address and the suggested
13:17location that it tracked down. Latitude
13:19and longitude, right? GPS coordinates.
13:21That's probably very approximate just
13:22based off of the IP address, and since
13:24I'm through Tor, not a big concern.
13:26Others are just images there, but let's
13:28try and cruise through this again. Spam,
13:30spam, spam, and we'll click send. Didn't
13:34even have to agree to the terms of use
13:35there. Cool. Let's hit our password.
13:37Aha, you see the hit? We're heading to
13:40client extend, and it returned success.
13:44But the payload here, ooh, looks like
13:48some base 64 code that we could probably
13:51track down. If it is simple base 64,
13:54right? Let me get into Kali Linux so we
13:56have a place to work. And really, it
13:57doesn't have to be Kali Linux. I just
13:59like to be in a Linux environment, and
14:00this is just kind of easy. I know I tend
14:02to use it for videos, but let me make a
14:04directory for a playground. I think I
14:06already have, so we could just jump in
14:08there as a place to work. And really,
14:09it's not super necessary. We're just
14:11going to try and echo out, paste, and
14:13pipe to standard output so that we can
14:15bring it in to our standard input of
14:18base 64 minus D to decode, and that will
14:21crap out, oh,
14:23uh, salted underscore underscore prefix,
14:26which indicates this is some encrypted
14:28content. Right? Obviously, this is all
14:30gibberish, nonsense, symbols, and
14:31non-printable characters that we can't
14:33read, but this is very likely encrypted
14:35data, like OpenSSL. That salted prefix
14:38does let us know, okay, this is probably
14:40a standard. Now, we could probably
14:41assume this encrypted data blob base 64
14:45dump is probably what we just provided
14:47and filled out in that form. They
14:49collect it from their own API
14:51client-extend for, hey, server-side them
14:54to now push it off to Telegram so that
14:56they've got some dumping ground of all
14:58the victims that they collect info for.
15:00Password, two-factor authentication,
15:02email, phone number, anything you
15:03provide. But if we start to get a little
15:05bit more curious now, though, if we
15:07really wanted to kind of drill down
15:09into, hey, how are you getting to the
15:11point of this Telegram stuff being
15:13weird? These errors that are popping up,
15:15this webpack code that we could deal
15:18with, but we don't really want to. Well,
15:20honestly, why don't we make it easy on
15:21ourselves because at least at the front
15:23run time, we saw we did have the post to
15:27this API/client-extend
15:30here. We knew we could trigger that and
15:32we knew this is probably oh, including
15:34some data like I as a variable right
15:37here. That's obviously the base 64 blob
15:40that is encrypted data content and they
15:42track that down with some variable or
15:44function name the letter Y. We could
15:47keep scrolling up. Maybe you saw some of
15:49the back and forth of oh, how they
15:50handle different languages, but look at
15:52this. Here's the letter Y a set as a
15:54function where we're using B as how they
15:59wrap or obfuscate around like the
16:00Crypto-JS library.
16:03Then they reference AES and they decrypt
16:05it or encrypt it. Y is the encrypted
16:07data that they send along, but there's
16:09nothing really stopping us from being
16:10able to recreate that code if we could
16:13see the password like they're passing in
16:16one of these variables or arguments
16:17here. If we could determine that
16:19passphrase, oh,
16:21literally the letter O, it's this value
16:25up here. So, you could walk through the
16:28exact same steps. Run the same code with
16:30the Crypto-JS library and decrypt any
16:32data just like that. We really don't
16:34need to fall down that rabbit hole, but
16:35just in case you were interested like at
16:37least within Linux, we could just fire
16:39it up and run JavaScript code with
16:40Node.js. If you wanted to get some
16:42packages to be able to oh, use Crypto-JS
16:45as that library, let's go ahead and
16:47install that and then we could just kind
16:50of carve out our own decrypt routine.
16:52This is super dumb. This is literally
16:54code you could crap out with ChatGPT.
16:57We've made enough sense of it that we
16:58know we'll use that library what helps
17:00offer OpenSSL capability in JavaScript.
17:03We found the passphrase and we can just
17:05sort of wrap around oh, the exact same
17:07functions that they use here. We decrypt
17:09it and then we could see what exactly
17:11was passed. So, for funsies, if we
17:13really wanted to, we could try to run
17:15that and we'll paste in that base 64
17:18payload and yeah, I don't know what you
17:20expect. That's exactly what we filled
17:23out in our form. Say that we were to
17:24keep falling down the rabbit hole here
17:26though, let's add a little bit more
17:28nonsense and we could actually keep
17:30going through these. You might be able
17:31to catch more communication right back
17:34again to client extend, fill in our fake
17:38two-factor code. Once again, they keep
17:40adding to it to tie that to the victim.
17:43Extend, hence the name of the data that
17:45they're collecting. Let's go through
17:47another round of random nonsense to see
17:49how far along we'll go. Will we still
17:51keep sending to client {dash} extend?
17:53This is our last one here, I think.
17:54Third time's the charm, right? Okay, we
17:56kick it to client extend and then it
17:59just gives us our success {dot} PNG, but
18:00no other communication after that. I
18:02wonder if we could see any new data from
18:04that field. Back to use our decryption
18:07tool, we don't need all of that old base
18:1064. Let's just pass in the new one and
18:14that now includes our two-factor
18:16nonsense and the password, the second
18:18entries that we provided. Here's the
18:20thing though, since we totally know,
18:22okay, that's the call that's happening
18:23and we could track down where in the
18:25sources that was happening to begin
18:27with, if you wanted to, we could just
18:30kind of set breakpoints wherever we want
18:33and just let the developer tools browser
18:36ultimately let it run, unravel and then
18:39we could see exactly what data is passed
18:41where and when and how. So, I'm clicking
18:43on the sidebar here to enable these
18:44break points, you can see. And then if I
18:47were to get right back to our form and
18:49field, let's see, can I exit this out
18:51and try to trigger another query? Do it.
18:54Yeah, okay, cool. So, we can see all of
18:56the local variables including, okay,
18:58what's returning from this, the data
19:01itself and what was passed in while we
19:04encrypt or decrypt. Let me move forward
19:06a little bit. There, you can see exactly
19:08the I value while it is encrypted and
19:10the original string that it was working
19:12with including all of those raw values.
19:14So, even if we couldn't track down oh,
19:17the Telegram XFill dumping ground, I
19:20thought, "Hey, maybe there's still some
19:22neat little learnings whether it is
19:23exploring webpack parts and pieces or at
19:26least tracking down and determining,
19:29okay, if it's client-side, if it is all
19:31just in JavaScript, why not go find how
19:33they're performing their encryption if
19:35they are." So, while I was preparing
19:37recording this video, I did think, "You
19:39know what? The meta business manager
19:41lure in fishing email itself is kind of
19:43clever. I don't know if folks have seen
19:45that out and about before. I don't know
19:47if there was any threat intel write-ups
19:48about it." I did see over on Reddit,
19:50which of course I can't even say that's
19:52a threat intelligence source, Lewis Boye
19:55says, "Hey everyone, I want to share a
19:56highly convincing fishing attempt I just
19:58received to see if anyone else has
19:59encountered this." He walks through the
20:01same sort of explanation that I was kind
20:02of walking you through, takes a look at
20:04it with URL scan, really likes the fact
20:07that the view request button is still
20:09100% business.facebook.com.
20:11And a lot of people are like, "Yeah, I'm
20:13seeing this all the time, my guys." I
20:15guess I'm pretty late to the party if
20:16everyone was talking about this like 10
20:18days ago. But yeah, I mean, honestly,
20:19just ignore them. I have a hunch the
20:21Facebook business manager application
20:23lets you like ask a new partner and that
20:25will send an email notification that
20:27looks like this, but it's literally
20:29filling in, "Hey, the name of the
20:31business or the name of the individual
20:33to have a URL and link included in
20:36there." Again, I think, "Hey, you know
20:38what? What do we say? What's our grade?
20:41If you all let me know in the comments,
20:42is this like a B+ fishing email? Maybe
20:45an A? C? I don't know where you're at.
20:47But the fishing website, okay, like
20:50already kind of caught by Cloudflare, a
20:51lot of them are down. You get a little
20:53bit of brownie points in the Telegram is
20:54at least now tucked away server-side and
20:56not naked in the JavaScript. But none of
20:58these links work. You don't do any
21:00validation. It's just It's dumb. Don't
21:03fall for this.