Trustwave has reported a new scheme in which threat actors are using the popular Facebook Messenger platform to steal Facebook login credentials.

According to the report, the threat actors are using a phishing email to Facebook users that employs Meta’s Messenger chatbot feature. The message states that the user’s page will be terminated because the user has violated Facebook’s community standards. The email appears to be coming from Facebook’s support team, alleges the user can appeal the termination within 48 hours, and urges the user to click on the “Appeal Now” link.

The Appeal Now link then directs the user to a website that prompts the user to “Start Now,” which then asks the user to enter their credentials, including a pop-up asking for the user’s password. It all looks legitimate because the threat actors have spoofed the Facebook logo.

Once the threat actors have those credentials, they are able to gain full access to the user’s account.

Trustwave states that the website has been taken down, but “there is no reason to believe another threat actor might not use the same tactic in the future.”

This scheme shows how threat actors are using sophisticated techniques to obtain credentials and reiterates the importance of being particularly vigilant when it comes to account credentials on any platform.