A Finnish cybersecurity firm has sounded the alarm about a new type of Facebook malware that attempts to compromise business accounts for financial gain. Credit: Thinkstock Helsinki-based cybersecurity vendor WithSecure (formerly F-Secure Business) says it has discovered an operation, dubbed “DUCKTAIL,” that uses social media-based spear phishing attacks to gain access to Facebook Business accounts.The company said that it has “high confidence” that a Vietnamese threat actor is behind the attacks, which aim malicious messages at LinkedIn users who are likely to have admin access to their companies’ Facebook accounts. The threat actor also targets email addresses of potential victims directly.What makes the attack unique, according to WithSecure, is the infostealer malware component, which is designed specifically to gain access to Facebook Business accounts. Previous attacks targeting Facebook did not target Facebook Business accounts in particular. If a victim can be induced to open a malicious link, the malware scans the infected computer for browsers and extracts cookies that indicate authenticated Facebook sessions for use in gaining access to those accounts. Command and control is handled via the Telegram messaging service, using the Telegram Bot system, and private data is also sent back to the hacker in this way. Hacked accounts can provide the bad actor with a wealth of information, including 2FA codes, IP addresses and geolocation, financial details and credit card numbers, and much more. It can also compromise Facebook advertising accounts. Mohammad Kazem Hassan Nejad, a researcher for WithSecure, said that the malicious actor behind the DUCKTAIL attacks has been careful in selecting the malware’s targets.“We believe that the DUCKTAIL operators carefully select a small number of targets to increase their chances of success and remain unnoticed,” he said in a statement announcing the company’s findings. “We have observed individuals with managerial, digital marketing, digital media, and human resources roles in companies to have been targeted.” The company has been tracking the DUCKTAIL attacks since earlier this year, and said that that the malware has been under continuous development since the second half of 2021, adding new feature sets as Facebook updates its security measures.According to WithSecure, Facebook’s security has been stalwart enough to ward off many attacks that have been attempted over the years, but it and other social media networks remain tempting targets for bad actors, thanks to the near-universal userbase that such platforms provide. Related content news analysis SEC rule for finance firms boosts disclosure requirements Amendments to Regulation S-P requires broker-dealers, investment companies, registered investment advisers, and transfer agents to disclose incidents to customers. By Evan Schuman May 17, 2024 5 mins Data Breach Financial Services Industry Data Privacy feature DDoS attacks: Definition, examples, and techniques Distributed denial of service (DDoS) attacks have been part of the criminal toolbox for over twenty years, and they’re only growing more prevalent and stronger. By Josh Fruhlinger May 17, 2024 10 mins DDoS Cyberattacks news FCC proposes BGP security measures Protecting the Border Gateway Protocol is as important as protecting the border. By Gyana Swain May 17, 2024 1 min Regulation Network Security news US AI experts targeted in cyberespionage campaign using SugarGh0st RAT Threat actors use phishing techniques to obtain non-public information about generative artificial intelligence. By Lucian Constantin May 16, 2024 4 mins Phishing Data and Information Security PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe