TechDogs-"WithSecure Detects New Infostealer Malware DUCKTAIL"

Cyber Security

WithSecure Detects New Infostealer Malware DUCKTAIL

By Business Wire

Business Wire
Overall Rating

DUCKTAIL has been targeting marketing and HR professionals through LinkedIn spear phishing campaigns to hijack Facebook business accounts for financial gains

HELSINKI, Finland--(BUSINESS WIRE)--WithSecure™ has discovered an ongoing operation, dubbed "DUCKTAIL", that targets individuals and organizations operating on Facebook's Ads and Business platform. Based upon analysis and gathered data, WithSecure™ has high confidence that the operation is conducted by a Vietnamese threat actor. The chain of evidence suggests that the threat actor's motives are financially driven.

DUCKTAIL's operations utilize an infostealer malware component that includes functionality specifically designed to hijack Facebook Business accounts. This is the first instance of such functionality that WithSecure™ is aware of, and it separates DUCKTAIL from earlier Facebook-centric malware operations. The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim's Facebook account and ultimately hijack any Facebook Business account to which the victim has sufficient access.

WithSecure™ has found DUCKTAIL scouting for and phishing its targets via LinkedIn, where it selects users likely to have high-level access to a Facebook Business account, especially those with admin privileges.

"We believe that the DUCKTAIL operators carefully select a small number of targets to increase their chances of success and remain unnoticed. We have observed individuals with managerial, digital marketing, digital media, and human resources roles in companies to have been targeted," said Mohammad Kazem Hassan Nejad, Researcher for WithSecure™ Intelligence.

Initially discovered as an unknown malware earlier this year, WithSecure™ started tracking and analyzing the operation and found that the threat actor had been developing and distributing the DUCKTAIL-linked malware since the second half of 2021. The DUCKTAIL operation has since continued to update and push out the malware in an attempt to improve its ability to bypass existing or new Facebook security features alongside other implemented features.

While WithSecure™ has detections in place for endpoint protection platforms (EPP) and endpoint detection and response (EDR) solutions such as static and behavioural detection signatures, and detections for multiple stages of the attack lifecycle, Mohammad Kazem Hassan Nejad also adds that vigilance and alertness are key to avoiding becoming a victim, "Many spear phishing campaigns target users on LinkedIn. If you are in a role that has admin access to corporate social media accounts, it is important to exercise caution when interacting with others on social media platforms, especially when dealing with attachments or links sent from individuals you are unfamiliar with." Mohammad Kazem Hassan Nejad added.

The popularity of social networks and media platforms remains on the rise. Unfortunately, this attracts cybercriminals to find ways of abusing these platforms for their own gains, such as using them for malware distribution, theft, disinformation campaigns, and fraud. Malware targeting social platforms such as Facebook has thus far been relatively uncommon due to the security mechanisms implemented by the platforms. Still, the wide outreach and user base make it an interesting attack vector for threat actors to abuse.

WithSecure ™ had shared its DUCKTAIL research prior to release with Facebook’s parent company Meta. A detailed report about DUCKTAIL's operation and an overview of the attack using the MITRE framework can be found from

About WithSecure™
WithSecure™, formerly F-Secure Business, is cyber security's reliable partner. IT service providers, MSSPs and businesses – along with the largest financial institutions, manufacturers, and thousands of the world's most advanced communications and technology providers – trust us for outcome-based cyber security that protects and enables their operations. Our AI-driven protection secures endpoints and cloud collaboration, and our intelligent detection and response are powered by experts who identify business risks by proactively hunting for threats and confronting live attacks. Our consultants partner with enterprises and tech challengers to build resilience through evidence-based security advice. With more than 30 years of experience in building technology that meets business objectives, we've built our portfolio to grow with our partners through flexible commercial models.

WithSecure™ Corporation was founded in 1988, and is listed on NASDAQ OMX Helsinki Ltd.


WithSecure™ media relations
Mark Fletcher

Liked what you read? Head to the TechDogs homepage to find the latest tech content infused with drama and entertainment. We've got ArticlesWhite PapersCase StudiesReportsVideos and Events that help you Know Your World of Technology.

First published on Tue, Jul 26, 2022

Enjoyed what you've read so far? Great news - there's more to explore!

Stay up to date with the latest news, a vast collection of tech articles including introductory guides, product reviews, trends and more, thought-provoking interviews, hottest AI blogs and entertaining tech memes.

Plus, get access to branded insights such as informative white papers, intriguing case studies, in-depth reports, enlightening videos and exciting events and webinars from industry-leading global brands.

Dive into TechDogs' treasure trove today and Know Your World of technology!

Disclaimer - Reference to any specific product, software or entity does not constitute an endorsement or recommendation by TechDogs nor should any data or content published be relied upon. The views expressed by TechDogs’ members and guests are their own and their appearance on our site does not imply an endorsement of them or any entity they represent. Views and opinions expressed by TechDogs’ Authors are those of the Authors and do not necessarily reflect the view of TechDogs or any of its officials. All information / content found on TechDogs’ site may not necessarily be reviewed by individuals with the expertise to validate its completeness, accuracy and reliability.


WithSecure™ Endpoint Protection Platforms (EPP) Social Networks Cybercriminals Cyber Security IT Service

Join The Discussion

- Promoted By TechDogs -

Are You Ready To Accelerate Your Cloud Migration And Data Modernization?
  • Dark
  • Light