A group of attackers, likely based in Vietnam, that specializes in targeting employees with potential access to Facebook business and ads management accounts, has re-emerged with changes to its infrastructure, malware, and modus operandi after being initially outed a few months ago.
Dubbed DUCKTAIL by researchers from WithSecure, the group uses spear phishing to target individuals on LinkedIn who have job descriptions that could suggest they have access to manage Facebook business accounts. More recently, the attackers were also observed targeting victims via WhatsApp. The compromised Facebook business accounts are used to run ads on the platform for attackers’ financial gain.
More Stories
DOGE Worker’s Code Supports NLRB Whistleblower
A whistleblower at the National Labor Relations Board (NLRB) alleged last week that denizens of Elon Musk’s Department of Government...
Regulating AI Behavior with a Hypervisor
Interesting research: “Guillotine: Hypervisors for Isolating Malicious AIs.” Abstract:As AI models become more embedded in critical sectors like finance, healthcare,...
Verizon’s DBIR Reveals 34% Jump in Vulnerability Exploitation
After a 180% rise in last year’s report, the exploitation of vulnerabilities continues to grow, now accounting for 20% of...
FBI Reveals “Staggering” $16.6bn Lost to Cybercrime in 2024
The FBI found that cybercrime losses climbed by 33% compared to 2023, driven by tactics like investment fraud and BEC...
Vulnerability Exploitation and Credential Theft Now Top Initial Access Vectors
Mandiant’s M-Trends report found that credential theft rose significantly in 2024, driven by the growing use of infostealers Read More
US Data Breach Victim Count Surges 26% Annually
The latest ITRC data finds breach volumes remained flat in Q1 but victim numbers increased 26% annually Read More