Fake AI advertising apps stole Meta Business logins

What happened

Mimecast found phishing emails, with subjects such as "Google Gemini LLC has invited you to test Google Gemini Advertising", that sent marketing and social media staff to malicious App Store apps. More than 35,000 coordinated attacks hit targets in the US, UK and Australia in April.

Once installed, the app showed a Facebook / Meta login screen instead of the promised tool.

What was found

The apps exist to capture logins for Meta Business Manager, ad accounts and payment methods, and public App Store reviews describe data theft and unauthorized account access. Mimecast says it has strong indicators linking the campaign to Vietnamese actors who trade Meta Business Manager accounts, without naming a group.

Data at risk

• Meta Business logins
• Ad accounts
• Payment methods

What you should do

1. 1Do not install apps from "test invitation" links in email; find the official developer in the App Store and read reviews first.
2. 2Check the domain and where the login screen comes from before signing in to Meta.
3. 3If you entered Meta credentials in such an app, change the password, review Business Manager members and payment methods, and turn on two-factor authentication.