A new wave of phishing attacks is exploiting Google’s AppSheet platform to impersonate Meta and evade traditional email security systems, according to research by KnowBe4 Threat Labs.
Since March 2025, KnowBe4 has seen a sharp rise in phishing emails sent via AppSheet. On April 20 alone, 10.88% of all phishing emails blocked by KnowBe4’s Defend platform came through AppSheet. Of those, 98% pretended to be from Meta, while 2% mimicked PayPal.
The phishing emails claim to be from the “Facebook Support Team” and copy Meta’s branding. They contain urgent warnings about account deletion and include a prominent “Submit an Appeal” button. Clicking the button directs users to a fake login site designed to steal credentials.
“The email looks convincing, using Meta’s style and an official-looking signature,” said KnowBe4. “However, the footer links don’t work, and the email uses pressure tactics to push users into acting quickly.”
Each email includes a unique case ID generated by AppSheet. This use of polymorphic identifiers makes detection harder, as security filters struggle to find consistent patterns.
KnowBe4 explains that the phishing site acts as a man-in-the-middle proxy. When a user enters their login and 2FA details, the site sends that information in real time to the actual Meta servers. This gives the attacker immediate access to the account by hijacking the session token.
This tactic is part of a wider trend where hackers abuse legitimate platforms to avoid detection. KnowBe4 has seen similar phishing campaigns using services from Microsoft, Google, QuickBooks, and Telegram. These trusted platforms, combined with convincing designs and social engineering, help bypass even advanced email security tools like Microsoft 365 and SEGs.
Ashley Stephens, an account manager at Hotwire Australia, commented, “This campaign shows how cybercriminals are evolving. They use trusted services and human manipulation to get around traditional defenses. Organisations must focus not just on technology, but also on managing human risk, supported by AI tools.”
KnowBe4 also emphasized the growing use of Integrated Cloud Email Security solutions that use AI to detect advanced phishing threats. They recommend regular security awareness training based on real-world examples to help staff spot future attacks.
KnowBe4 Threat Labs continues to monitor these evolving phishing campaigns and advises a multi-layered approach. Combining technical defenses, user education, and AI monitoring is key to staying protected against modern cyber threats.
