Friday, June 21, 2024

Ducktail Operation – Hackers May Steal Your Credentials From Web Browser

WithSecure Labs, researchers uncovered a cyber operation named Ducktail in July 2022, where threat actors employed information-stealing malware to specifically target marketing and HR professionals with spear-phishing campaigns through LinkedIn direct messages, focusing on individuals and employees with potential access to Facebook business accounts.

The Ducktail campaign can compromise Facebook business accounts and misuse the ad feature for malicious advertising. While along with Facebook, LinkedIn is also now actively targeted by threat actors for cybercriminal activities. 

Trend Micro’s Managed XDR team in March 2023 found a file that collects user data and connects to Facebook and Telegram domains during their investigation of Ducktail-related incidents.

Operation Ducktail

How the Attackers Trick Victim

The sample file’s name, referencing a marketing director job opening, appears specifically tailored to attract marketing professionals by hinting at a higher leadership position.

Although the exact delivery method of these links to the target is uncertain, the historical use of LinkedIn messages by Ducktail suggests it as a potential means.

Experts determined the contents and source of the archive by examining the file name, and upon investigating the domain, they discovered that the malicious file was hosted on Apple’s iCloud service, although the URL is currently inactive.

Upon analyzing the created processes, security researchers identified three, including separate processes for Microsoft Edge and Google Chrome, which collect the victims’ IP addresses and geolocation data.

Here below, we have mentioned the arguments that are used in these processes:-

  • –headless
  • –disable-gpu
  • –disable-logging
  • –dump-dom

The last process is used to open a PDF file, and the complete details about the fake job are embedded inside this PDF. 

The malware operates by extracting browser credentials and acquiring Facebook-related information. At the same time, victims read the spawned PDF file, storing it in a temporary text file before exfiltrating it using Telegram every 10 minutes.

Due to the frequent use of social engineering lures by contemporary threat actors, both individuals and organizations need to exercise caution when opening links or downloading files from unknown sources, regardless of whether they are delivered through renowned social media platforms or means like:-

  • LinkedIn
  • Facebook
  • Email

Security Recommendations

Here below, we have mentioned all the best security practices that could help users mitigate spear-phishing attacks:-

  • Beware of unexpected emails; exercise caution.
  • Always verify the sender’s identity before opening attachments from unknown sources.
  • Avoid suspicious links, especially from unknown or suspicious sources.
  • Educate employees on spear phishing to recognize and avoid it.
  • Enable multi-factor authentication for added security.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles