Targeted campaign uses infostealer to hijack Facebook Business accounts – Help Net Security

by | Jul 26, 2022 | Business

WithSecure researchers have discovered an ongoing operation, dubbed “DUCKTAIL”, that targets individuals and organizations operating on Facebook’s Ads and Business platform.
Based upon analysis and gathered data, the company has high confidence that the operation is conducted by a Vietnamese threat actor. The chain of evidence suggests that the threat actor’s motives are financially driven.
The campaign and malware
DUCKTAIL’s operations utilize an infostealer malware component that includes functionality specifically designed to hijack Facebook Business accounts. This is the first instance of such functionality that WithSecure is aware of, and it separates DUCKTAIL from earlier Facebook-centric malware operations. The infostealer is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim’s Facebook account and ultimately hijack any Facebook Business account to which the victim has sufficient access.

The company has found DUCKTAIL scouting for and phishing its targets via LinkedIn, where it selects users likely to have high-level access to a Facebook Business account, especially those with admin privileges.
“We believe that the DUCKTAIL operators carefully select a small number of targets to increase their chances of success and remain unnoticed. We have observed individuals with managerial, digital marketing, digital media, and human resources roles in companies to have been targeted,” said Mohammad Kazem Hassan Nejad, Researcher for WithSecure Intelligence.
Initially discovered as an unknown malware earlier this year, WithSecure started tracking and analyzing the operation and found that the threat actor had been developing and distributing the DUCKTAIL-linked malware since the second half of 2021. The DUCKTAIL operation has since continued to update and push out the malwa …

Article Attribution | Read More at Article Source

Share This