Back Ground.News

30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign

Ground.News • May 2, 2026

A newly discovered Vietnamese-linked operation has been observed using a Google AppSheet as a "phishing relay" to distribute phishing emails with an aim to compromise accounts. The activity has been codenamed AccountDumpling by Guardio, with the scheme selling the stolen accounts back through an illicit storefront run by the threat actors. In all, roughly 30,000 accounts are

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

30,000 Facebook Accounts Compromised in Google AppSheet Phishing Scheme A Vietnamese-linked cyber operation, codenamed AccountDumpling, has compromised around 30,000 Facebook accounts through a sophisticated phishing campaign. The attackers exploited Google AppSheet to send fully authenticated phishing emails, bypassing traditional email security measures. This method allowed them to harvest user credentials and identity documents effectively. The stolen accounts are being sold on an illicit marketplace operated by the threat actors. Guardio Labs discovered this operation, highlighting its global impact. The campaign also utilizes platforms like Netlify and Telegram to enhance its reach and effectiveness. Currently, there are no specific patches or CVEs mentioned to mitigate this threat. Organizations are advised to enhance their email security protocols and user education to combat such phishing attempts. 13 sources 68

Extracted Entities

30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Tools (1)