Topic starter
02/08/2026 9:45 am
TL;DR: Attackers are abusing Meta Business Manager partner requests to send genuine Meta emails that pass SPF, DKIM and DMARC, while the embedded link leads to credential harvesting, according to Prophet Security. The pattern shows why phishing defence now depends on intent, destination validation and deeper URL investigation rather than sender trust alone.
Editorial analysis by NHI Mgmt Group, based on content published by Prophet: “Facebook Phishing Email Campaign: How Attackers Are Weaponizing Meta Business Manager Partner Requests”.
Key questions
Q: What breaks when phishing uses a trusted SaaS workflow instead of spoofed email?
A: Header-based trust checks break first, because the message is genuinely sent by the platform and passes normal authentication.
Q: Why do authenticated emails still create phishing risk?
A: Because authentication proves who sent the message, not whether the message is trustworthy to the recipient.
Q: What are the signs that a trusted-platform phishing campaign is active?
A: Look for genuine notifications that contain off-domain links, recently registered lookalike domains, and landing pages that mimic the original service’s onboarding or verification flow.
Practitioner guidance
- Tighten partner-request approval controls Restrict who can approve Meta Business Manager partner requests and require out-of-band verification for any unexpected invitation to business assets.
- Inspect destination mismatch before click-through Score the destination domain against the claimed brand, registration age and hosting relationship before the message reaches users or analysts.
- Correlate email authentication with URL intelligence Use sender authentication as a starting point, then combine it with live threat intelligence and page-content review for off-domain links.
Bottom line: The core risk is not spoofed sender identity but abuse of a legitimate platform workflow to deliver a malicious destination.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:38 pm
Trusted-email phishing is now an intent problem, not a header problem. SPF, DKIM and DMARC still matter, but they no longer answer the question that decides user risk: does the message content and destination match the business workflow it claims to represent? When the platform itself sends the email, sender trust becomes a weak control boundary. Practitioners should treat message intent and destination integrity as the real security test.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: How should security teams respond when partner-invitation phishing targets business accounts?
A: They should treat partner invitations as delegated access events, not simple email alerts. That means validating the request through a second channel, limiting who can approve it, and reviewing which downstream assets the approval could expose. The goal is to stop the approval path before credentials or portfolio access are handed over.
👉 Read our full editorial: Meta Business Manager phishing bypasses sender trust checks