Why 30,000 People Fell for a Phishing Scam That Looked Like Google

When Trusted Names Hide Dangerous Traps

A Vietnamese cybercriminal operation recently stole more than 30,000 Facebook accounts using a technique that bypassed most people's defenses. They did this by routing their phishing attacks through Google AppSheet, a legitimate Google service. The stolen accounts were then sold on underground marketplaces, putting thousands of families at risk.

The Details

Here's what made this attack so effective: the criminals didn't send emails from suspicious addresses. Instead, they used Google AppSheet, a real tool that businesses use to build simple applications. When victims received phishing messages, the links appeared to come from Google's own domain. Email security systems flagged nothing unusual because technically, the messages were coming from Google.

When people clicked these links, they landed on pages that looked like Facebook login screens. Because the initial link came from a trusted Google domain, victims felt safe entering their usernames and passwords. The fake pages captured this information and sent it directly to the attackers.

The operation ran long enough to compromise 30,000 accounts before being discovered. Those accounts were then packaged and sold to other criminals who used them for everything from spreading more scams to impersonating real people. The victims often had no idea their accounts were compromised until friends reported strange messages or posts.

Who Is Affected

This threat impacts anyone with a Facebook account, but certain groups face higher risk. Parents managing family photos and communication through Facebook should be especially alert. Seniors who trust familiar brand names like Google are particularly vulnerable to this tactic.

Small business owners who use Facebook for customer outreach are also prime targets. A compromised business account can damage your reputation and expose your customers to follow-up scams. If you've ever clicked a link that asked you to re-enter your Facebook login, you need to read the next section carefully.

What You Should Do Right Now

1. Check your Facebook account activity right now. Go to Settings > Security and Login > Where You're Logged In. If you see unfamiliar locations or devices, log them out immediately and change your password.

The Bigger Picture

This attack represents a troubling evolution in phishing tactics. Criminals are no longer just pretending to be trusted companies. They're actively using trusted services as weapons against us. Traditional advice like "check the sender's email address" no longer protects you when the sender actually is Google. Staying safe now requires understanding that legitimate tools can be misused, and verification must happen at multiple steps.

How GetCyberRight Can Help

Our GCR Scam Guard tool was designed exactly for threats like this. It analyzes links even when they come from trusted domains like Google, checking where they ultimately lead and what they're really asking for. Scam Guard looks beyond the domain name to identify phishing attempts hiding behind legitimate services. It's the extra layer of protection families need when traditional security advice isn't enough.