Phishers Hijack Meta/Google Ad Accounts for Profit

How the attack worked

Criminal groups are stealing Meta Business Manager and Google Ads accounts using phishing that arrives through trusted platforms rather than obviously malicious infrastructure. According to the findings, about one in three detections arrived through Salesforce infrastructure, and another quarter came through Google Workspace mail-merge tools and SharePoint-hosted links. A typical lure impersonates Meta Business Support or Google Ads, warning the recipient of an account issue and pushing them to click a link and sign in, which harvests their credentials.

Why it succeeded

The core reason this works is trust transference. Sending through Salesforce, Google Workspace, or SharePoint means the sending IP, domain, and authentication records like SPF and DKIM all pass checks that would normally reject an unknown domain. As the reporting puts it, threat actors have moved away from purpose-built malicious infrastructure and toward legitimate, high-reputation sending platforms that email security tools are configured to trust. Once the delivery problem is solved, the attacker's only remaining task is making the message content convincing enough to prompt a click.

What to watch for

• Account or security notices that arrive via a third-party platform (Salesforce, mail-merge tooling, SharePoint links) rather than a direct, expected notification
• Urgent language asking you to verify or restore access to a Meta or Google Ads account through an embedded link
• Requests to sign in from a link instead of navigating directly to the known platform
• Sudden appearance of unfamiliar admins or reduced permissions on an ad account, which attackers use to lock out the real owner

Why aged accounts are valuable

Beyond the ad spend sitting in a compromised account, attackers specifically prize accounts with real history because aged, active accounts can serve ads that pass platform safety checks more easily. This is why stolen Meta Business Manager accounts and high-risk-sector Google Ads accounts show up for sale, with pricing reflecting how established and trusted the account appears.

How to build resistance

• Treat notices from trusted-looking platforms with the same scrutiny as unknown senders, since attackers use them specifically to bypass reputation-based filtering
• Go directly to Meta Business Manager or Google Ads by typing the address or using a saved bookmark instead of clicking links in notices
• Limit the number of admins on ad accounts, review roles regularly, and watch for unauthorized admin additions
• Respond quickly if spend or access looks unfamiliar; stopping fraudulent spend can often happen within hours, but reclaiming ownership and rebuilding standing with the platform's review systems can take months

Why do stolen ad accounts sell for money?

Aged, active accounts with real ad history can pass platform safety checks more easily, making them valuable for running scam ads. Stolen Meta Business Manager accounts have reportedly sold for about $15 to $340, and some Google Ads accounts for $200 to $270.

How do attackers deliver these phishing messages without getting flagged?

They send phishing through trusted platforms like Salesforce, Google Workspace mail-merge tools, and SharePoint-hosted links, since these services carry sending reputations that bypass reputation-based email filtering.

What happens after an attacker gets into an ad account?

Attackers often add themselves as admins and downgrade the legitimate owner's permissions, which can make reclaiming the account and rebuilding platform standing take months.

What should marketing and admin teams do to reduce this risk?

Avoid signing in through links in account notices, go directly to Meta or Google Ads instead, limit and regularly review who has admin access, and monitor for unfamiliar admin changes.