10 Critical Facts About the Massive Facebook Account Hack via Google AppSheet

In a sophisticated cyber operation detected by security firm Guardio, a Vietnamese-linked threat group has leveraged Google AppSheet as a phishing relay to compromise approximately 30,000 Facebook accounts. Dubbed AccountDumpling, this campaign targets unsuspecting users with deceptive emails and sells hijacked accounts through an illicit marketplace. Below are ten essential details about the attack and how to stay safe.

1. What Is the AccountDumpling Campaign?

AccountDumpling is the codename assigned by Guardio to a phishing operation that uses Google's own AppSheet platform as an intermediary. AppSheet, a low-code application builder, is repurposed to host fake login pages and relay stolen credentials. The campaign has been active for months, specifically targeting Facebook accounts for financial gain.

2. Who Is Behind the Attack?

Security analysts have linked the operation to a Vietnamese threat actor or group. While specific attribution remains under investigation, the group operates an underground storefront where compromised accounts are resold. This indicates a well-organized cybercriminal enterprise focused on credential theft and account trafficking.

3. How Does Google AppSheet Play a Role?

Attackers exploit Google AppSheet's legitimate functionality to create phishing pages that appear authentic. AppSheet apps can be configured to collect user input, which the hackers then redirect to their own servers. By abusing a trusted Google service, the campaign bypasses many email security filters.

4. The Phishing Emails: Lures and Tricks

Victims receive emails that mimic official Facebook notifications, such as security alerts, login requests, or messages about policy violations. The emails contain links to AppSheet-hosted pages that ask for email, password, and sometimes 2FA codes. The design closely replicates Facebook's interface to lower suspicion.

5. Scale of the Compromise: 30,000 Accounts

Guardio estimates that approximately 30,000 Facebook accounts have been looted so far. Given the operation's ongoing nature, the number may rise. Each stolen account is cataloged and sold for between $1 to $5 depending on profile completeness and activity level.

6. How Stolen Accounts Are Monetized

Compromised accounts are offered on a dedicated dark web storefront run by the threat actors. Prices vary: verified business pages fetch higher amounts, while personal accounts with many friends are also in demand. Buyers use them for spamming, phishing, or identity theft.

7. The Role of Guardio and Detection

Guardio, a cybersecurity firm, discovered the campaign through threat intelligence monitoring. They analyzed phishing URLs, email headers, and AppSheet metadata to trace the operation. Their findings were shared with law enforcement and platform providers to disrupt the infrastructure.

8. Why This Campaign Is Unusual

Using Google AppSheet as a phishing relay is a novel tactic. Most attacks rely on malicious domains or spoofed pages, but this method leverages a legitimate cloud service to gain trust. It also makes takedowns slower because the phishing content is hosted within an approved platform.

9. Immediate Risks for Facebook Users

If your account is compromised, the attacker can change passwords, lock you out, and post spam or malicious links on your behalf. They may also access private messages and friend lists for further targeting. Affected accounts often get flagged by Facebook but not before damage is done.

10. How to Protect Yourself Right Now

• Enable two-factor authentication (2FA) using an authenticator app, not SMS.
• Never click on unexpected login notifications – always go directly to facebook.com.
• Check your Facebook “Security and Login” settings for unfamiliar sessions.
• Be wary of emails asking for verification; report them to phish@fb.com.
• Use a unique, strong password for your Facebook account updated regularly.

The AccountDumpling campaign highlights how cybercriminals adapt legitimate tools for malicious purposes. By staying vigilant and following security best practices, you can significantly reduce your risk of falling victim to such phishing operations. For more details, refer to Guardio’s full report or your account security dashboard.