{"success":true,"data":{"id":"fake-meta-business-suite-suspension-lure","label":"Fake Meta Business Suite / Facebook Ads Manager / Instagram Ads suspension lure — \"ad account suspended for policy violation, verify business within 24 hours or permanently disabled\" targeting 10M+ Meta advertisers; admin credentials + 2FA harvest enables ad-spend drain ($5-500K/account), connected Pages hijack, Instagram Business pivot, WhatsApp Business impersonation, custom-audience PII exfil","description":"Fake \"your Meta Business Suite / Facebook Ads Manager / Instagram Ads account has been suspended for policy violation — verify your business within 24 hours or your ad account will be permanently disabled\" email targeting the 10M+ Meta advertiser base. Harvests Meta admin credentials and 2FA codes. Post-compromise attackers: (1) drain the ad-spend budget with attacker-controlled ads (scam crypto ads, fake shopping deals, malware droppers) — ad accounts commonly hold $5-500K of committed spend; (2) pivot to connected Facebook Pages to hijack the brand's social presence and post scams to the follower base; (3) pivot to Instagram Business for the same attack vector on a different audience; (4) pivot to WhatsApp Business for customer-service impersonation fraud; (5) exfil ad-performance data and custom-audience lists (PII from uploaded customer lists). The lure converts because Meta DOES routinely suspend ad accounts for policy reviews, payment issues, and automated-abuse flags — the \"action required within 24 hours\" UX is real and Meta's legitimate account-disabled emails look structurally identical to the phish. Sophos and Proofpoint documented sustained 2024-2025 campaigns. Fires when body references Meta Business Suite / Meta Business / Facebook Business / Facebook Ads Manager / Instagram Ads / Meta Ads / FB Ads AND contains suspension / policy-violation / business-verification / permanently-disabled / ad-spend-paused urgency. Excludes facebook.com, facebookmail.com, fb.com, meta.com, metamail.com, instagram.com, instagrammail.com, whatsapp.com, business.facebook.com, business.instagram.com. Auto-classified as danger via the `-lure` suffix.","tier":"danger","category":"scam","isThin":false}}