DuckTail

DUCKTAIL is a financially motivated cybercrime operation and malware family attributed to a Vietnam-linked threat actor. The activity has focused on compromising individuals and organizations that use Facebook Business and Ads, especially employees in managerial, digital marketing, digital media, and human resources roles who are likely to hold privileged access to business advertising accounts. Delivery has commonly relied on social engineering through professional networking platforms and cloud-hosted lure archives themed around business documents, projects, brands, or job opportunities. The operation is best known for combining information stealing with Facebook Business account hijacking. DUCKTAIL malware is typically implemented in .NET, including later .NET Core single-file and 64-bit .NET Core 5 variants, and has also been observed using .NET ahead-of-time compilation to complicate reverse engineering. Core functionality includes enumerating installed browsers, locating browser profiles, stealing cookies and related browser metadata, identifying Facebook session cookies, and using those sessions from the victim host to query Facebook resources in a way intended to blend with legitimate activity. When a compromised account is associated with a Facebook Business environment, the malware attempts to add attacker-controlled email addresses with elevated business roles such as administrator and finance editor, enabling takeover through normal platform workflows. Exfiltration has been observed via Telegram. The actor has repeatedly evolved its infection chains. Earlier campaigns used archives containing malicious executables alongside decoy files, while later waves prominently used malicious LNK files that launched obfuscated PowerShell to retrieve additional stages from public hosting services. Observed tradecraft includes command obfuscation with caret characters, string concatenation and replacement, oversized padded LNK files to evade sandbox and scanning limits, staged PowerShell downloaders, deletion of initial artifacts to reduce forensic visibility, and shifting payload hosting across multiple public services and attacker-controlled infrastructure. During experimentation, the actor also delivered commodity stealers such as Doenerium and Vidar instead of its custom malware, and reporting also notes Ducktail among threat actors that have used DarkGate. DUCKTAIL employs anti-analysis and defense-evasion measures, including environment checks, debugger and sandbox detection, process-count thresholds, and signed payloads using certificates tied to fake businesses. Additional observed behavior includes browser and system reconnaissance, checking internet connectivity, and collecting victim metadata relevant to account abuse. The operation has shown sustained malware development since at least 2021, with indications of earlier cybercriminal activity, and is widely assessed as pursuing monetization through abuse of compromised advertising accounts rather than espionage.