# Meta Phishers Abuse Business Account Manager Service

Meta business partner-request emails injected attacker URLs via the partner display name, luring businesses to phishing pages that stole credentials, MFA codes and ID documents.

- Payout: Real-world hack
- Severity: medium
- Program: Meta
- Analysis by: Huntress
- Disclosed: 2026-07-07
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/meta-business-manager-phishing
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-meta-business-manager-phishing
- Tags: area:web domain:web impact:ato impact:pii-leak kind:incident platform:threat-intel sev:medium tech:email technique:recon vuln:auth-bypass vuln:info-disclosure

**Target:** Meta Business Manager partner-request email service
**Root cause:** The partner-request email template auto-inserts the requesting partner's business name into a sentence; the name field accepted a short sentence containing a URL, so attacker-controlled links appeared inside a legitimate Meta email.
**Steps:**
1. Create a Meta business account and set the business/owner name to a short sentence containing a URL, e.g. `Get started [URL] – Your information`
2. Initiate a business partnership request to a target, sending email from Meta's legitimate address
3. Recipient sees `Get started [URL] – Your information is not part of or affiliated with Meta.` and follows the URL to `sites.google[.]com/view/profile1012`
4. Google Sites page redirects to phishing landing page (e.g. `aussiecleaningservices[.]com`) impersonating Meta Agency Partner Program
5. Page collects username, password, MFA code, phone, email and business name, exfiltrating to `api.goautolink[.]com` or a Telegram bot channel
6. Later variant: URL leads to a Facebook Messenger bot 'AI Strategic Partner' whose buttons open Netlify-hosted pages framed under `sw[.]run`
7. Phish asks credentials twice (fake 'password incorrect'), then TOTP code (faking two failures), then upload of passport/driver's license/National ID
**How found:** Huntress observed a phishing email in a honeypot on June 2 and traced the mechanics: the awkward injected sentence in the Meta email revealed the partner-name field as the injection point, then followed the URLs through Google Sites, Messenger bot and Netlify pages while capturing exfil traffic to Telegram.
**Exploitation:** Attacker registers a business account, embeds a URL in the partner name, and sends partnership-request emails from Meta's own domain to bypass email trust. Victims are funneled through Google Sites/Messenger bot to credential-harvesting pages that capture passwords, MFA codes and identity documents, delivered to attacker Telegram channels. Stolen accounts allow spending victim ad budgets or full takeover via changed recovery methods and password.
**Escalation:** Campaign evolved from static Google Sites lure to a Messenger chatbot with framed Netlify pages to better conceal the phishing domain; captured business accounts enable further targeted attacks on the victim's customers and followers.
**Insight:** Legitimate transactional email templates that interpolate user-controlled display names are a phishing delivery vector from a trusted domain; check whether name fields accept URLs or sentences and whether the rendered link is clickable.