This screenshot shows an Arabic‑language phishing page impersonating Facebook. The page asks for the victim’s email address and password under the pretext of “logging in” before accessing content or claiming a reward.
Threat Analysis: Facebook Phishing – Credential Harvesting (Arabic Variant)
How it works:
The victim receives a phishing email, SMS, or social media message claiming a security alert, account verification, or a prize that requires logging in. The link leads to this page, which mimics the Facebook login interface. The victim is asked to enter their email address and password and click the login button (labeled “الاختر” – likely a typo or variant of “دخول”). The credentials are captured and sent to the attacker.
The goal:
The attacker steals Facebook account credentials to:
- Take over the victim’s Facebook account
- Access private messages and personal information
- Post spam or malicious links from a trusted account
- Use the account to spread further phishing messages to friends
- Attempt credential reuse on other platforms (email, banking, etc.)
Red flags to watch for:
- Suspicious URL: The page is hosted on a domain that is not
facebook.com. Legitimate Facebook login pages are only on official Facebook domains. - Unsolicited login request: Facebook does not send links requiring users to log in to resolve account issues or claim rewards.
- Minimal design / missing security features: The page lacks Facebook’s full branding, language selection, and two‑factor authentication options.
- No personalization or account selection: A real Facebook login often displays a profile photo or saved account – this page does not.
- Poor Arabic phrasing / typos: The login button text may contain a typo, which would not appear on an official Facebook page.
What to do if you encounter this:
- Do not enter your email address or password.
- If you have already entered your credentials, change your Facebook password immediately and enable two‑factor authentication (2FA). Also check for any unauthorized activity or connected apps.
- Always access Facebook by typing
facebook.comdirectly into your browser.
Protective measures:
- Bookmark the official Facebook login page and use that bookmark.
- Use a password manager – it will autofill only on legitimate
facebook.comdomains. - Enable two‑factor authentication on your Facebook account.
- Be suspicious of any unsolicited message that asks you to log in via a link.