Lily Collins — the Hack, Not the Actress — Wants Your Facebook Account

Savio Payyappilly is an international influencer out of San Diego who is active on various social media platforms which is to say he spends a whole lot of time in front of a computer. Lately for the wrong reasons though, as he still can’t figure out how in the world he lost control of his Facebook accounts so quickly.

“I didn’t want to click on this link because I thought I was getting scammed, but then I tried to log on to my Facebook app on my phone and I realized I got hacked,” he said as he showed us a Facebook alert he received pointing to unusual activity on his account, only it didn’t use his name but the name Lily Collins, as in the actress.

It was what is known as the Lily Collins hack! A moniker earned by the hackers changing profile names and pictures to the actress. It sure did a number on Payyappilly’s personal and business Facebook accounts. It locked him out and cost him money from a side hustle he has as an international influencer.

“I’m not losing money but I’m not able to run my business because I’m not able to find new clients,” he said sitting in front of his computer, staring at the screen.

This hack is spreading quickly. We found many accounts that, just like Payyappilly’s, seem to have been renamed Lily Collins with matching profiles and cover photos of the actress.

So if tech-savvy Savio could be hacked, what hope is there for the rest of us? Well, how about we fight fire with fire by having a “white hat” hacker show us how this works and what we should look out for.

“Think before you click, don’t just click on something because your friend sent it to you,” said Nikolas Behar, Professor of Cybersecurity at the University of San Diego. He says this virus is sent as an ad for a Chat GPT application from a cloned or stolen account from someone you may know.

Think before you click, don't just click on something because your friend sent it to you.

USD Cybersecurity Professor Nikolas Behar

“Once it finds your Facebook cookies, then it establishes a Facebook session on your behalf because it has those cookies, then it could go ahead and change your profile name to Lily Collins, or they could message your friends on your behalf,” said the professor adding that this is exactly how the virus jumps from one page to the next.

And it may not stop there. If you’ve logged into any other sites using your Facebook credentials, the hackers may be able to access those too.

Here’s how to keep your accounts secure.

• Don’t trust links sent to you by anyone without verifying first what they are.
• Avoid linking accounts to Facebook. Log in using your email instead.
• Set up unique passwords for each online account you have with two-factor authentication if available.
• Be sure to sign up to receive alerts for unrecognized log-ins to our Facebook account.
• Notify friends and family as soon as you find out you’ve been hacked

META, which owns Facebook, told NBC 7 Responds:

“We know how frustrating it can be to lose access to your account and our teams continue to help people get back in. We’re aware of instances where people got locked out of their accounts this way, often due to email compromise, phishing or downloading malicious browser extensions. We encourage everyone to be cautious about clicking on suspicious links and downloading unknown software”

Facebook also told us they have created a page dedicated to account recovery 

Professor Behar says once your account is taken over, good luck to you, as it can be a daunting task trying to recover it.

Payyappilly agrees. He finally got his personal account back but continues to try to regain control of his business page. “I try contacting them, and they just keep ping-ponging me,” he said.

Also, keep in mind that some malware can also grab other passwords you have stored in your device or computer, so like the professor said, “Think before you click.”