New PHP Version of Ducktail Malware Hijacking Facebook Business Accounts

A PHP variation of an details-stealing malware referred to as Ducktail has been found out in the wild getting dispersed in the form of cracked installers for genuine applications and video games, according to the most current results from Zscaler.

“Like older versions (.NetCore), the most recent version (PHP) also aims to exfiltrate sensitive information linked to saved browser credentials, Fb account facts, etcetera.,” Zscaler ThreatLabz scientists Tarun Dewan and Stuti Chaturvedi said.

Ducktail, which emerged on the menace landscape in late 2021, is attributed to an unnamed Vietnamese danger actor, with the malware generally made to hijack Fb organization and promoting accounts.

The financially determined cybercriminal operation was initial documented by Finnish cybersecurity firm WithSecure (formerly F-Safe) in late July 2022.

Whilst prior versions of the malware were being identified to use Telegram as a command-and-management (C2) channel to exfiltrate details, the PHP variant noticed in August 2022 establishes connections to a newly hosted web-site to retail outlet the info in JSON format.

Attack chains observed by Zscaler entail embedding the malware in ZIP archive documents hosted on file-sharing providers like mediafire[.]com, masquerading as cracked versions of Microsoft Place of work, online games, and porn-associated data files.

Execution of the installer, in turn, activates a PHP script that finally launches the code responsible for stealing and exfiltrating info from web browsers, cryptocurrency wallets, and Facebook Organization accounts.

“It seems that the danger actors driving the Ducktail stealer marketing campaign are continually creating changes or improvement in the shipping and delivery mechanisms and technique to steal a broad selection of delicate user and process details concentrating on end users at huge,” the researchers stated.

Identified this write-up interesting? Adhere to THN on Facebook, Twitter  and LinkedIn to go through more exceptional material we put up.

Some parts of this article are sourced from:
thehackernews.com