How phishing emails impersonate social media platforms

# Threat Studies

# Phishing

Fake notifications and offers seen in 2026

Herman Heliste

Social media platforms are widely recognized brands all around the world, with billions of daily users. Personal accounts often hold years of photos and messages with friends, so many people have good reason to pay attention to emails about their accounts.

With so many users, social media is a channel businesses use to reach customers. For employees who manage business accounts, social media platforms are a regular part of work, which makes these employees targets for phishing emails impersonating those platforms.

Some of these impersonations target personal and business accounts alike, while others are aimed specifically at businesses. Below, we look at examples of both types, all reported by Hoxhunt users in 2026. The real-world details they include range from Grok references to a Meta employee's photo.

Verification offers

Hoxhunt's threat analysts have observed that social media impersonations aimed specifically at business accounts are often more positive in tone than those that can target any account. One common theme in these business-targeted emails is account verification, which appeals to recipients who want the credibility a verified badge can signal.

The phishing email below appeals to this interest by mimicking a genuine Meta email about verification, which cites a statistic on how much more people trust verified businesses. The phishing email uses an image from the genuine email and repeats the statistic (Figure 1). However, its text, including the statistic, contains grammatical and formatting errors that the genuine email wouldn't. Accurate visuals paired with flawed text have been common in social media impersonations analyzed by Hoxhunt, though flawless text doesn't mean an email is legitimate.

Content violation notices

Social media impersonations that can target any account, personal or business, more often use threatening language. A frequent approach is a fake notice about a content violation, warning that the recipient's account may be suspended.

A fake violation notice can seem plausible even to a recipient who believes they followed the rules, if they allow for the possibility of flaws in moderation. A recipient who thinks their account was wrongly flagged would want to correct the mistake. Fake notices exploit this by including a button that appears to let the recipient appeal the decision. A fast-approaching deadline adds pressure to do so before the account is suspended.

The fake X content violation notice below follows this pattern (Figure 2). It claims the recipient's content violated community guidelines and gives them 48 hours to request a review or risk having their page suspended.

Login notifications

Social media platforms are also impersonated in fake login notifications. Like the threat of suspension, the threat of unauthorized access is relevant to anyone with an account.

Attackers model these emails on the genuine login alerts that social media platforms send. Fake notifications describe login activity the recipient wouldn't recognize, such as a login from another country. This suggests the recipient's account has been compromised and creates urgency to secure it. In fake login notifications, a link for doing so leads to a malicious site.

The fake Facebook login notification below is written in Finnish and includes an embedded map showing the supposed login location in France (Figure 3). The map and logos load from Facebook's domains, which suggests they were taken from other, genuine Facebook emails. Phishing emails that impersonate social media platforms commonly reuse images this way.

Ad performance offers

Businesses that advertise on social media care about how their campaigns perform, and attackers play on this by offering to improve their results. As with the verification email earlier in this post, the recipient is offered something positive.

In the phishing email below, the sender impersonates a Meta employee and introduces themselves as the recipient's Agency Partner Manager. They claim the recipient's ad performance is below expectations and offer a one-on-one Zoom call to review and improve their campaigns, with a link to book it. The email, sent from a non-Meta address, also includes a banner with the impersonated employee's photo and details along with a Meta logo (Figure 4). The banner is an image loaded from a URL whose ending matches the file name format ChatGPT uses for generated images, which suggests it was at least partly AI-generated.

Verifying social media emails

The emails in this post reuse genuine visual elements, but their sender addresses and main links point to domains that don't belong to the impersonated social media platform. Other impersonations skip links and use callback phishing instead, asking the recipient to call a phone number. Whatever the email asks, the safest approach, aside from reporting it, is to confirm the sender through another trusted route or to check the claim using the platform's app or a saved bookmark.