Back Scworld

Vietnamese operation uses Google AppSheet for Facebook phishing, targets 30000 accounts

Scworld • May 2, 2026

As detailed in The Hacker News, a sophisticated phishing operation linked to Vietnamese threat actors has been discovered leveraging Google AppSheet as a relay to distribute malicious emails aimed at compromising accounts. This operation, codenamed AccountDumpling by Guardio, has reportedly led to the hacking of approximately 30,000 accounts.

The AccountDumpling campaign targets Business account owners with emails impersonating Meta Support, creating a false sense of urgency to prompt users to click on links leading to fake credential harvesting pages. These phishing emails are sent from a legitimate Google AppSheet address, allowing them to bypass spam filters. The operation employs various lures, including account disablement, copyright complaints, and fake job offers, to trick victims. Data collected includes credentials, two-factor authentication codes, personal information, and government ID photos, often exfiltrated to Telegram channels.

Evidence, including metadata from generated PDFs, points to a Vietnamese individual named PHẠM TÀI TÂN as being behind the operation. The stolen accounts are then sold on illicit marketplaces, highlighting a growing trend of trusted platforms being repurposed for malicious activities and the commercialization of compromised digital assets.

Source: The Hacker News

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

30,000 Facebook Accounts Compromised in Google AppSheet Phishing Scheme A Vietnamese-linked cyber operation, codenamed AccountDumpling, has compromised around 30,000 Facebook accounts through a sophisticated phishing campaign. The attackers exploited Google AppSheet to send fully authenticated phishing emails, bypassing traditional email security measures. This method allowed them to harvest user credentials and identity documents effectively. The stolen accounts are being sold on an illicit marketplace operated by the threat actors. Guardio Labs discovered this operation, highlighting its global impact. The campaign also utilizes platforms like Netlify and Telegram to enhance its reach and effectiveness. Currently, there are no specific patches or CVEs mentioned to mitigate this threat. Organizations are advised to enhance their email security protocols and user education to combat such phishing attempts. 13 sources 68

Vietnamese operation uses Google AppSheet for Facebook phishing, targets 30000 accounts

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)