Loading story…
DuckTail is a financially motivated malware operation linked to Vietnamese threat actors that targets people with access to Facebook Business and advertising accounts, especially marketing and advertising professionals. Researchers said the group commonly uses fake LinkedIn job offers, recruiter impersonation, spear-phishing emails, and bogus marketing or AI-themed websites to deliver malicious archives, often hosted on public cloud services, Trello, or shortened-link infrastructure. Victims are persuaded to open Windows archive files and manually launch malware disguised as documents or job materials, sometimes with decoy files or even instructional videos to improve infection success.
Once executed, DuckTail steals browser cookies and abuses already authenticated Facebook sessions to take over accounts and add attacker-controlled access to business assets. Multiple variants have been observed, including large .NET executables, LNK files that trigger obfuscated PowerShell, Delphi-based loaders, malicious browser extensions, and deployments of commodity stealers such as Doenerium and Vidar. The malware has used Telegram for exfiltration and command-and-control, fake or Vietnamese-linked code-signing certificates, and infrastructure tied to Vietnam; one campaign also used Facebook API requests and the 2fa[.]live service to help bypass two-factor authentication, with detections spanning India, Europe, Asia, the Middle East, and the Americas.
Pull IOCs and campaign context straight into your stack.
11 events from the most recent confirmed update back to the earliest known activity.
ThreatLabz published research focused on how DuckTail is distributed, describing fake LinkedIn recruiter personas, job-offer lures targeting marketing professionals, malicious archives hosted on cloud services or Trello, and attribution clues pointing to Vietnamese operators.
Deep Instinct published analysis of DUCKTAIL's re-emergence, detailing its LNK- and PowerShell-based infection chains, use of public hosting services, and occasional substitution of commodity stealers such as Doenerium and Vidar.
By mid-February 2023, DUCKTAIL resumed attacks using both the older executable-based chain and the newer LNK/PowerShell chain. The wave delivered a 64-bit .NET Core 5 DUCKTAIL payload signed with a new valid certificate and incorporated techniques tested in late 2022.
Deep Instinct observed the operation becoming active again at the beginning of February 2023 after earlier quiet periods that followed public reporting.
Unit 42 reported a previously unreported phishing campaign that began around December 2022 and used two Python-based NodeStealer variants to steal Facebook business account data, browser credentials, and MetaMask wallets. One variant also attempted full Facebook account takeover by purchasing mailbox accounts from Vietnamese services and changing victims' Facebook email addresses.
From November to December 2022, Deep Instinct observed DUCKTAIL relying mainly on archives containing malicious LNK files that launched PowerShell to fetch later stages, while the actor continued experimenting with obfuscation and hosting changes.
In October 2022, Deep Instinct observed DUCKTAIL delivering its custom .NET malware through its established archive-and-executable infection chain, including decoy images and videos.
WithSecure published research on DUCKTAIL as an infostealer targeting people with access to Facebook Business accounts, assessing the actor as Vietnamese and financially motivated. Before release, WithSecure shared its research with Meta, which said it was aware of the scammers and regularly enforced against them.
Securelist described Ducktail as a malware family active since the second half of 2021, aimed at stealing Facebook business accounts.
Securelist said the analyzed 2023 Ducktail campaign persisted from March through early October 2023, with telemetry showing India as the most affected country and additional detections across Europe, Asia, the Middle East, North America, and South America.
Securelist reported a Ducktail campaign running between March and early October 2023 that targeted marketing professionals with fake clothing-company job materials. This campaign used Delphi instead of the earlier .NET-based approach and deployed a malicious browser extension to steal Facebook-related sessions and account data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
zscaler.com
Open sourceunit42.paloaltonetworks.com
Open sourcedeepinstinct.com
Open sourceforensicitguy.github.io
Open sourcesecurelist.com
Open sourcelabs.withsecure.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors used fake Facebook job advertisements and impersonation content, including lures themed around Amazon CEO Andy Jassy and DocuSign, to distribute the Windows information stealer **Ov3r_Stealer**. Trustwave SpiderLabs found victims were redirected to Discord-hosted `.url` shortcut files and, in some cases, weaponized PDFs, which triggered a multi-stage infection chain involving `control.exe`, malicious `.cpl` loaders, PowerShell scripts fetched from GitHub, and a final DLL sideloading payload delivered from a remote SMB share. Once installed, **Ov3r_Stealer** established persistence through scheduled tasks running every 90 minutes and harvested browser credentials, crypto wallets, FTP and Discord data, documents, and system information before exfiltrating the data to attacker-controlled Telegram bots and channels. Researchers said the malware was under active development, with alternate delivery methods including HTML smuggling, SVG smuggling, and LNK masquerading, and noted strong similarities to the open-source **Phemedrone Stealer**; the activity was linked to aliases including **Liu Kong**, **John Macollan**, **MR Meta**, and **MeoBlackA**, with indications the operator may be offering the malware as a service.
Aug 14, 2026
Researchers reported two large phishing operations that abused trusted platforms to improve delivery and evade defenses. Guardio said the **AccountDumpling** campaign used Google AppSheet to send emails from legitimate Google infrastructure while impersonating **Meta Support** and recruiters, luring Facebook Business users with fake account disablement notices, copyright complaints, and job offers. The operation compromised about **30,000 Facebook accounts** across roughly **50 countries**, stealing credentials, `2FA` codes, personal data, and government ID images; the stolen information was often funneled through Telegram channels, and the hijacked accounts were later sold or monetized through fraudulent advertising and scams. Evidence in generated PDF metadata linked the activity to Vietnam-based operators, including an individual identified as **PHẠM TÀI TÂN**. Microsoft separately disclosed an adversary-in-the-middle phishing campaign that used fake workplace compliance notices to target more than **35,000 users** at **13,000 organizations** in **26 countries**, with most activity concentrated in the United States. Attackers posed as internal HR and compliance teams, sent urgent messages with attached PDFs, and pushed victims through redirects, CAPTCHA checks, and a counterfeit Microsoft sign-in page designed to steal session tokens rather than just passwords, allowing account access without the victim's second factor. The incidents show how attackers are increasingly relying on legitimate cloud services and convincing enterprise-themed lures to bypass spam controls, defeat traditional authentication protections, and accelerate account takeover at scale.
Jun 29, 2026
Researchers reported that the **SYS01** information stealer has been active since at least 2022, targeting **Facebook business and advertising accounts** through social-engineering lures delivered by fake Facebook profiles, Google ads, and ZIP archives masquerading as games, adult videos, movies, and cracked software. The malware is also tracked as **Album Stealer** or **S1deload Stealer**, and campaigns have used compromised Facebook pages to distribute malicious archives that lure victims into launching the infection chain. SYS01 typically abuses **DLL sideloading** with legitimate signed applications, then deploys an **Inno Setup** installer and PHP-based payloads, with newer variants adding **Rust** and **Python** components and heavier obfuscation. Researchers said it steals browser credentials, cookies, Facebook session tokens, and business-account data, while also maintaining backdoor capabilities to download and run additional payloads, upload files, execute commands, and update itself from command-and-control infrastructure. The findings underscore how stealer malware continues to enable account takeover, fraud, and broader follow-on compromise.
Aug 14, 2026