Malware hijacks Facebook business accounts via phishing

Vietnamese threat actors are using a malware called Ducktail to hijack high-profile Facebook Business and advertising platform accounts.

The campaign was uncovered by security researchers at WithSecure. The malware uses browser cookies from authenticated user sessions to take over accounts and steal data.

“The malware is designed to steal browser cookies and take advantage of authenticated Facebook sessions to steal information from the victim’s Facebook account and ultimately hijack any Facebook Business account that the victim has sufficient access to,” researchers wrote on a blog post.

To spread the malware, the financially driven threat actors target LinkedIn users through a phishing campaign. This entices victims with brand, product, and project-related keywords to download an archive file containing the executable malware.

According to researchers, Ducktail works with six key components when it infects a system. It performs Mutex creation and ensures that only one instance of the malware works simultaneously.

Ducktail has two components that are dedicated to stealing files. The first scans an infected machine for Google Chrome, Microsoft Edge, Brave Browser or Firefox. It extracts all cookies in each of the browsers found, including Facebook session cookies.

The second component of information theft is the extraction of data from Facebook Business/Ads accounts that interacts directly with various Facebook endpoints.

The sources for this piece include an article in ThreatPost.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web