Ducktail Operation – Hackers May Steal Your Credentials From Web Browser

WithSecure Labs, researchers uncovered a cyber operation named Ducktail in July 2022, where threat actors employed information-stealing malware to specifically target marketing and HR professionals with spear-phishing campaigns through LinkedIn direct messages, focusing on individuals and employees with potential access to Facebook business accounts.

The Ducktail campaign can compromise Facebook business accounts and misuse the ad feature for malicious advertising. While along with Facebook, LinkedIn is also now actively targeted by threat actors for cybercriminal activities. 

Trend Micro’s Managed XDR team in March 2023 found a file that collects user data and connects to Facebook and Telegram domains during their investigation of Ducktail-related incidents.

How the Attackers Trick Victim

The sample file’s name, referencing a marketing director job opening, appears specifically tailored to attract marketing professionals by hinting at a higher leadership position.

Although the exact delivery method of these links to the target is uncertain, the historical use of LinkedIn messages by Ducktail suggests it as a potential means.

Experts determined the contents and source of the archive by examining the file name, and upon investigating the domain, they discovered that the malicious file was hosted on Apple’s iCloud service, although the URL is currently inactive.

Upon analyzing the created processes, security researchers identified three, including separate processes for Microsoft Edge and Google Chrome, which collect the victims’ IP addresses and geolocation data.

Here below, we have mentioned the arguments that are used in these processes:-

• –headless
• –disable-gpu
• –disable-logging
• –dump-dom

The last process is used to open a PDF file, and the complete details about the fake job are embedded inside this PDF. 

The malware operates by extracting browser credentials and acquiring Facebook-related information. At the same time, victims read the spawned PDF file, storing it in a temporary text file before exfiltrating it using Telegram every 10 minutes.

Due to the frequent use of social engineering lures by contemporary threat actors, both individuals and organizations need to exercise caution when opening links or downloading files from unknown sources, regardless of whether they are delivered through renowned social media platforms or means like:-

• LinkedIn
• Facebook
• Email

Security Recommendations

Here below, we have mentioned all the best security practices that could help users mitigate spear-phishing attacks:-

• Beware of unexpected emails; exercise caution.
• Always verify the sender’s identity before opening attachments from unknown sources.
• Avoid suspicious links, especially from unknown or suspicious sources.
• Educate employees on spear phishing to recognize and avoid it.
• Enable multi-factor authentication for added security.

Struggling to Apply The Security Patch in Your System? – 
Try All-in-One Patch Manager Plus