# AccountDumpling — Vietnamese-Linked Facebook Business Hijacking Campaign Abusing Google AppSheet (~30,000 Compromised Accounts)

> AccountDumpling is a long-running, Vietnamese-linked phishing operation tracked by Guardio Labs that abuses Google AppSheet's notification system to deliver SPF/DKIM/DMARC-authenticated emails impersonating Meta. The campaign has compromised ~30,000 Facebook accounts — primarily business and advertiser profiles — by harvesting credentials, 2FA codes, government IDs, and session tokens through Netlify/Vercel/Google Drive-hosted phishing flows backed by real-time Telegram operator panels.

- **Published:** 2026-05-04T12:00:00Z
- **Last reviewed:** 2026-05-04T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0453
- **ID:** TL-2026-0453
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** AccountDumpling Operators (Vietnam)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AccountDumpling is an industrial-scale, Facebook-focused phishing operation publicly disclosed by Guardio Labs (Shaked Chen) on 2026-05-03 and corroborated by Malwarebytes Labs on 2026-05-04. The operation has compromised approximately 30,000 Facebook accounts to date, with disproportionate impact on Facebook Business and advertiser profiles managed by SMBs, marketing agencies, brands, creators, and influencers across the United States, Italy, Canada, the Philippines, India, Spain, Australia, the United Kingdom, Brazil, and Mexico.

The operation's signature TTP is the abuse of Google AppSheet — Google's no-code app and workflow notification platform — as an authenticated phishing relay. Phishing emails are emitted from noreply@appsheet.com via the appsheet.bounces.google.com return path, inheriting Google's sender reputation and passing SPF, DKIM, and DMARC checks. The lures are uniformly Meta-themed urgency narratives: alleged Facebook policy violations, copyright complaints, account deletion notices, blue badge verification offers, suspicious login alerts, and recruiter outreach impersonating Meta, WhatsApp, Adobe, Pinterest, Apple, and Coca-Cola.

Guardio Labs documented four operational clusters. Cluster 1 directs victims to Netlify-hosted clones of the Facebook Help Center, with per-victim subdomains used to defeat URL blocklists, harvesting credentials, dates of birth, phone numbers, and government-issued ID photos. Cluster 2 runs on Vercel under names such as 'Security Check' or 'Meta | Privacy Center', preceded by a fake CAPTCHA gate, and intentionally rejects the first password attempt to force a retry that confirms credentials. Cluster 3 distributes Canva-generated PDFs hosted on Google Drive that masquerade as Meta verification instructions and chain to phishing pages with Socket.IO/WebSocket-driven operator panels capable of requesting additional 2FA codes, ID photos, and browser screenshots from victims in real time. Cluster 4 uses direct social engineering, with operators posing as recruiters from major brands to build trust before pivoting victims to attacker-controlled channels.

Stolen data — credentials, 2FA codes, recovery information, ID documents, and session tokens — flows in real time to private Telegram bots and channels, allowing operators to attempt account takeover before victims realize they have been phished. The phishing kits employ multiple evasion techniques including invisible Unicode characters, Cyrillic homoglyphs, mid-word text breaking, anti-debugging logic, encrypted localStorage, shortened URL chains, and full-screen iframe hiding. Vietnamese attribution is supported by Canva PDF metadata listing the author 'PHẠM TÀI TÂN' and OSINT links to Vietnamese-language digital marketing front sites; Guardio's researchers describe the body of evidence as 'a consistent picture of a large, Vietnamese-based, mega operation' though not a formal law enforcement attribution. Compromised accounts are monetized through fraudulent advertising, payment-method abuse, page resale in underground markets, brand impersonation against followers, and bogus 'account recovery' services upsold back to victims.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1589.002 Gather Victim Identity Information: Email Addresses
- T1583.006 Acquire Infrastructure: Web Services
- T1583.001 Acquire Infrastructure: Domains
- T1585.001 Establish Accounts: Social Media Accounts
- T1587.001 Develop Capabilities: Malware
- T1608.002 Stage Capabilities: Upload Tool
- T1566.002 Phishing: Spearphishing Link
- T1566.001 Phishing: Spearphishing Attachment
- T1566.003 Phishing: Spearphishing via Service
- T1078 Valid Accounts
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File
- T1036 Masquerading
- T1684.001 Impersonation
- T1027 Obfuscated Files or Information
- T1027.006 Obfuscated Files or Information: HTML Smuggling
- T1056.003 Input Capture: Web Portal Capture
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1556 Modify Authentication Process
- T1087 Account Discovery
- T1113 Screen Capture
- T1102 Web Service
- T1102.002 Web Service: Bidirectional Communication
- T1071.001 Application Layer Protocol: Web Protocols
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1531 Account Access Removal
- T1657 Financial Theft

## Sources

- [AccountDumpling — Hunting Down the Google-Sent Phishing Wave Compromising 30,000 Facebook Accounts](https://labs.guard.io/labs/accountdumpling---hunting-down-the-google-sent-phishing-wave-compromising-30-000-facebook-accounts)
- [Thousands of Facebook accounts stolen by phishing emails sent through Google](https://www.malwarebytes.com/blog/news/2026/05/thousands-of-facebook-accounts-stolen-by-phishing-emails-sent-through-google)
- [How AppSheet Phishing Put 30,000 Facebook Accounts at Risk](https://www.analyticsinsight.net/news/how-appsheet-phishing-put-30000-facebook-accounts-at-risk)
- [Google AppSheet Phishing Hits Facebook Accounts](https://digitalwarfare.com/google-appsheet-phishing-hits-facebook-accounts/)
- [MITRE ATT&CK — Phishing: Spearphishing Link (T1566.002)](https://attack.mitre.org/techniques/T1566/002/)
- [MITRE ATT&CK — Multi-Factor Authentication Interception (T1111)](https://attack.mitre.org/techniques/T1111/)
- [MITRE ATT&CK — Web Service (T1102)](https://attack.mitre.org/techniques/T1102/)
- [Meta Business Help Center — Account Security and Recovery](https://www.facebook.com/business/help)
- [CISA Guidance: Phishing-Resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0453