Facebook Phishing Kit 7c475854

This kit imitates the Facebook help center page and asks the user to enter their page name, email address, phone number & full name in order to 'unblock' their removed facebook page.

After filling out the form the user is prompted with a dialog box where they must enter their Facebook password for their 'security'.

References

IOK Rule (edit) 

title: Facebook Phishing Kit 7c475854
description: |
    This kit imitates the Facebook help center page
    and asks the user to enter their page name, email 
    address, phone number & full name in order to 'unblock' 
    their removed facebook page. 
    
    After filling out the form the user is prompted 
    with a dialog box where they must enter their 
    Facebook password for their 'security'.

references:
  - https://urlscan.io/result/7c475854-9102-4803-8293-11c4bc17142e
  - https://urlscan.io/result/36d2d95b-7a09-408e-abd9-710ff9703aa3
  - https://urlscan.io/result/3e88c0af-e0ad-4b42-af21-9ed13dec36f5

detection:

    faviconUrl:
        dom|contains: 'https://www.edigitalagency.com.au/wp-content/uploads/Facebook-logo-blue-circle-large-transparent-png.png'

    facebookLogo:
        requests|contains: 'netflixlogo-28853c47.png'

    pageTitle:
        title: 'Help Center'
      
    condition: faviconUrl and facebookLogo and pageTitle

tags:
  - kit
  - target.facebook