Story perspectives

Vietnam Hackers Phish 30,000 Facebook Accounts, Target U.S.

5/3/2026

Summary

Story summary

Vietnam-linked cybercriminals compromised 30,000+ Facebook accounts worldwide using the AccountDumpling phishing operation.
They sent AppSheet emails from noreply@appsheet.com that passed SPF, DKIM and DMARC checks and delivered Meta Support alerts, such as an April 2026 “Case ID: 6480258166” notice.
Credentials, 2FA codes and ID photos were sent to Telegram bots, with metadata tying the campaign to Pham Tài Tân of Vietnam and showing 68.6% of victims are in United States.

1 of 1

Story summary

Vietnam-linked cybercriminals compromised 30,000+ Facebook accounts worldwide using the AccountDumpling phishing operation.
They sent AppSheet emails from noreply@appsheet.com that passed SPF, DKIM and DMARC checks and delivered Meta Support alerts, such as an April 2026 “Case ID: 6480258166” notice.
Credentials, 2FA codes and ID photos were sent to Telegram bots, with metadata tying the campaign to Pham Tài Tân of Vietnam and showing 68.6% of victims are in United States.