Security researchers at Malwarebytes have uncovered a personalized iMessage scam that uses fake Facebook Marketplace listings to bait users. By listing the recipient as the seeller, attackers trick people into replying to a "Is this available?" text to verify their identity.
The 'Conversation Lure' using fabricated Facebook Marketplace listings
The current campaign employs a technique known as a "conversation lure," which differs from traditional phishing by avoiding immediate requests for passwords or malicious links. According to Malwarebytes, the attacker sends a text message asking if a specific item is still avialable for purchase, accompanied by an image that looks like a Facebook Marketplace listing. The psychological hook is that the listing identifies the recipient of the text as the seller.
This tactic is designed to trigger an immediate emotional response, such as confusion or fear that an identity thief is impersonating the user online. By prompting the user to reply with a correction—such as "That's not me"—the scammer achieves their primary goal: establishing a direct line of communication with a responsive target.
The mismatched profile photo in the Malwarebytes analysis
During their investigation, Malwarebytes researchers noticed a critical flaw in the scam's execution: the profile photo in the fake listing did not actually belong to the recipient. Instead, the image was traced back to a different Facebook user who happened to share the same name as the target. This suggests that scammers are likely utilizing breached data or scraped public information to pair names with phone numbers before generating the fake screenshots .
The use of these data sets allows attackers to create a veneer of legitimacy.. While the image is fabricated, the presence of the user's real name makes the message feel personal, overriding the natural skepticism a user might have toward a message from an unrecognized number.
Why the FTC warns against replying to unknown texts
While replying to a "wrong number" text may seem harmless, the Federal Trade Commission (FTC) warns that any response confirms to a scammer that a telephone number is active and monitored. As reported by Malwarebytes,a confirmed "live" number becomes a more valuable asset in the criminal underground and can be resold to other bad actors.
Once a number is verified, the target may face an increase in more aggressive scams. these could include fake delivery alerts, fraudulent bank notifications, or attempts to steal multi-factor authentication codes. By simply engaging with the initial lure, the user inadvertently flags themselves as a high-value target for future social engineering attacks.
AI agents and the automation of personalized lures
The scale of this campaign suggests a shift toward automation. Malwarebytes notes that while they have not confirmed AI was used in the specific example they analyzed, the use of AI agents could allow attackers to generate thousands of personalized Marketplace screenshots almost instantaneously. This removes the tedious manual work previously required to customize phishing lures for individual victims.
This evolution in tooling means that personal details—such as a full name or a specific city—no longer serve as indicators of a sender's legitimacy . The ability to automate personalization means that a message knowing your name provides very little reassurance that the sender is a known contact or a legitimate business entity.
Apple's iMessage protections against unknown senders
To combat these social engineering tactics, Apple has implemented default protections within iMessage that prevent users from opening links sent by unknown senders until the sender is added to contacts or a reply is sent. This safeguard is intended to create a buffer between the user and potentially malicious websites, though it does not prevent the initial "conversation lure" from reaching the device.
Apple recommends that users treat unexpected messages as potential scams and avoid responding entirely. Users are encouraged to use the built-in tools in the Messages app to filter unknown senders, report suspicious content, and block unwanted contacts to minimize their exposure to these campaigns.
Comments 0