Notifications
Clear all
Topic starter
02/08/2026 9:45 am
TL;DR: Attackers are abusing Meta Business Manager partner requests to send genuine Meta emails that pass SPF, DKIM and DMARC, while the embedded link leads to credential harvesting, according to Prophet Security. The pattern shows why phishing defence now depends on intent, destination validation and deeper URL investigation rather than sender trust alone.
NHIMG editorial — based on content published by Prophet: Facebook phishing email campaign using Meta Business Manager partner requests
Questions worth separating out
Q: How should security teams handle phishing that arrives through trusted email infrastructure?
A: Treat trusted infrastructure as a delivery path, not a guarantee of legitimacy.
Q: Why do legitimate partner-request emails create more risk than standard phishing?
A: Because the message can pass normal trust checks while still moving the victim into a high-privilege approval path.
Q: What breaks when phishing investigations stop at SPF, DKIM and DMARC?
A: They miss attacks where the sender is genuine but the destination is hostile.
Practitioner guidance
- Validate partner-request destinations before approval Block or escalate any partner invitation whose URL, domain age or hosting does not align with the claimed brand.
- Treat delegated business access as privileged access Inventory who can approve external partners, what assets those approvals touch and how far those permissions propagate across business units or clients.
- Correlate email authenticity with page content Require analysts to compare sender branding, link destination and landing-page language before clearing reports as safe.
What's in the full article
Prophet's full article covers the operational detail this post intentionally leaves for the source:
- The full investigation chain from header analysis to page-content review and cross-tool correlation.
- The specific malicious domains, subdomain patterns and reputation pivots observed during triage.
- The analyst workflow used to classify the message in under seven minutes.
- The broader campaign context across multiple customers and similar trusted-platform phishing patterns.
👉 Read Prophet's analysis of Meta Business Manager partner-request phishing →
Meta Business Manager phishing: are your controls checking intent?
Explore further
02/08/2026 12:38 pm
Trusted workflow abuse is now the core phishing problem. The security issue here is not forged email infrastructure but hostile use of legitimate SaaS notification systems. That shifts defensive focus from sender validation to workflow integrity, link destination analysis and approval governance. In practice, phishing programmes that stop at mail authentication will keep missing the most credible attacks.
A question worth separating out:
Q: Who is accountable when a fraudulent business partner request is approved?
A: Accountability usually sits with the team that owns delegated access governance, plus the business unit that approved the request. Email security can help detect the message, but it cannot replace access review, partner vetting and asset-level control over what an external request can reach.
👉 Read our full editorial: Meta Business Manager phishing bypasses sender trust checks
