Friday, March 1, 2024

Ducktail Operation – Hackers May Steal Your Credentials From Web Browser

WithSecure Labs, researchers uncovered a cyber operation named Ducktail in July 2022, where threat actors employed information-stealing malware to specifically target marketing and HR professionals with spear-phishing campaigns through LinkedIn direct messages, focusing on individuals and employees with potential access to Facebook business accounts.

The Ducktail campaign can compromise Facebook business accounts and misuse the ad feature for malicious advertising. While along with Facebook, LinkedIn is also now actively targeted by threat actors for cybercriminal activities. 

Trend Micro’s Managed XDR team in March 2023 found a file that collects user data and connects to Facebook and Telegram domains during their investigation of Ducktail-related incidents.

Operation Ducktail

How the Attackers Trick Victim

The sample file’s name, referencing a marketing director job opening, appears specifically tailored to attract marketing professionals by hinting at a higher leadership position.

Although the exact delivery method of these links to the target is uncertain, the historical use of LinkedIn messages by Ducktail suggests it as a potential means.

Experts determined the contents and source of the archive by examining the file name, and upon investigating the domain, they discovered that the malicious file was hosted on Apple’s iCloud service, although the URL is currently inactive.

Upon analyzing the created processes, security researchers identified three, including separate processes for Microsoft Edge and Google Chrome, which collect the victims’ IP addresses and geolocation data.

Here below, we have mentioned the arguments that are used in these processes:-

  • –headless
  • –disable-gpu
  • –disable-logging
  • –dump-dom

The last process is used to open a PDF file, and the complete details about the fake job are embedded inside this PDF. 

The malware operates by extracting browser credentials and acquiring Facebook-related information. At the same time, victims read the spawned PDF file, storing it in a temporary text file before exfiltrating it using Telegram every 10 minutes.

Due to the frequent use of social engineering lures by contemporary threat actors, both individuals and organizations need to exercise caution when opening links or downloading files from unknown sources, regardless of whether they are delivered through renowned social media platforms or means like:-

  • LinkedIn
  • Facebook
  • Email

Security Recommendations

Here below, we have mentioned all the best security practices that could help users mitigate spear-phishing attacks:-

  • Beware of unexpected emails; exercise caution.
  • Always verify the sender’s identity before opening attachments from unknown sources.
  • Avoid suspicious links, especially from unknown or suspicious sources.
  • Educate employees on spear phishing to recognize and avoid it.
  • Enable multi-factor authentication for added security.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus


Latest articles

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...

BEAST AI Jailbreak Language Models Within 1 Minute With High Accuracy

Malicious hackers sometimes jailbreak language models (LMs) to exploit bugs in the systems so...

Hackers Hijack Anycubic 3D Printers to Display Warning Messages

Anycubic 3D printer owners have been caught off guard by a series of unauthorized...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles