New Ducktail Infostealer Malware Targeting Facebook Business and Ad Accounts

Facebook business and advertising accounts are at the receiving
end of an ongoing campaign dubbed Ducktail
designed to seize control as part of a financially driven
cybercriminal operation.

“The threat actor targets individuals and employees that may
have access to a Facebook Business account with an
information-stealer malware,” Finnish cybersecurity company
WithSecure (formerly F-Secure Business) said^[1]
in a new report.

“The malware is designed to steal browser cookies and take
advantage of authenticated Facebook sessions to steal information
from the victim’s Facebook account and ultimately hijack any
Facebook Business account that the victim has sufficient access
to.”

The attacks, attributed to a Vietnamese threat actor, are said
to have begun in the latter half of 2021, with primary targets
being individuals with managerial, digital marketing, digital
media, and human resources roles in companies.

The idea is to target employees with high-level access to
Facebook Business accounts associated with their organizations,
tricking them into downloading supposed Facebook advertising
information hosted on Dropbox, Apple iCloud, and MediaFire.

In some cases, the archive file containing the malicious payload
is also delivered to victims through LinkedIn, ultimately allowing
the attacker to take over any Facebook Business account.

An information-stealing malware written in .NET Core, the binary
is engineered to use Telegram for command-and-control and data
exfiltration. WithSecure said it identified eight Telegram channels
that were used for this purpose.

It works by scanning for installed browsers such as Google
Chrome, Microsoft Edge, Brave Browser, and Mozilla Firefox to
extract all the stored cookies and access tokens, alongside
stealing information from the victim’s personal Facebook account
such as name, email address, date of birth, and user ID.

Also plundered are data from businesses and ad accounts
connected to the victim’s personal account, allowing the adversary
to hijack the accounts by adding an actor-controlled email address
retrieved from the Telegram channel and grant themselves Admin and Finance editor^[2] access.

While users with Admin roles have full control over the Facebook
Business account, users with Finance editor permissions can edit
business credit card information and financial details like
transactions, invoices, account spend, and payment methods.

Telemetry data gathered by WithSecure shows a global targeting
pattern spanning a number of countries, including the Philippines,
India, Saudi Arabia, Italy, Germany, Sweden, and Finland.

That said, the company noted it was “unable to determine the
success, or lack thereof” of the Ducktail campaign, adding it
couldn’t determine how many users have potentially been
affected.

Facebook Business administrators are advised to review their access permissions^[3] and remove any unknown
users to secure the accounts.

The findings are yet another indicator of how bad actors are
increasingly banking on legitimate messaging apps like Discord and
Telegram, abusing their automation features to propagate malware or
meet their operational goals.

“Primarily used in conjunction with information stealers,
cybercriminals have found ways to use these platforms to host,
distribute, and execute various functions that ultimately allow
them to steal credentials or other information from unsuspecting
users,” Intel 471 said^[4]
Tuesday.