New information-stealing malware targeting Facebook accounts


By MYBRANDBOOK


New information-stealing malware targeting Facebook accounts

A new Ducktail phishing campaign is spreading a never-before-seen Windows information-stealing malware written in PHP used to steal Facebook accounts, browser data, and cryptocurrency wallets. Ducktail phishing campaigns were first revealed by researchers in July, who linked the attacks to Vietnamese hackers.

 

Zscaler has spotted the signs of new activity involving a refreshed Ducktail campaign that uses a PHP script to act as a Windows information-stealing malware. Ducktail has now replaced the older NET Core information-stealing malware used in previous campaigns with one written in PHP.

 

The campaigns relied on social engineering attacks through LinkedIn, pushing .NET Core malware masquerading as a PDF document supposedly containing details about a marketing project. The malware targeted information stored in browsers, mainly focusing on Facebook Business account data, and withdrew it to a private Telegram channel that acted as a C2 server. These stolen credentials are then used for financial fraud or to conduct malicious advertising.

 

Most of the fake lures for this campaign are related to games, subtitle files, adult videos, and cracked MS Office applications. These are hosted in ZIP format on legitimate file hosting services. When executed, the installation takes place in the background while the victim sees fake ‘Checking Application Compatibility’ pop-ups in the frontend, waiting for a fake application sent by the scammers to install.

 

The stealer’s code is an obfuscated (Base64) PHP script, which is deciphered directly on memory without touching the disk, minimizing the chances of being detected. The targeted data includes extensive Facebook account details, sensitive data stored in browsers, browser cookies, cryptocurrency wallet and account information, and basic system data.

 

Users are advised to be alert with instant messages on LinkedIn and treat file download requests with extra caution, especially cracked software, game mods, and cheats.

 E-Magazine 
 VIDEOS  Placeholder image

Copyright www.mybrandbook.co.in @1999-2024 - All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of Kalinga Digital Media Pvt. Ltd. is prohibited.
Other Initiatives : www.varindia.com | www.spoindia.org