This morning Matrix located a file containing Facebook user credentials stolen using a phishing attack.
The malicious site is “ab-portalwiedza.xyz”.
16 hours after the report of the attack, the site is still online even if the file containing the credentials is no longer visible, I imagine because the criminal changed its name.
The site presents itself as an article from the Polish news site “wiadomosci.wp.pl” and the article talks about an alleged particularly brutal news story.
At the end of the article, an alleged video is presented, to access which however Facebook credentials are required.
After entering the credentials in the popup that requests them, you will be redirected to Google. Credentials gone.
eca's blog 