DuckTail

Ducktail is a Windows-based information-stealing malware family and associated financially motivated operation focused on hijacking Facebook Business and advertising accounts.

DuckTail

Family profile

Ducktail is a Windows-based information-stealing malware family and associated financially motivated operation focused on hijacking Facebook Business and advertising accounts. Active since at least the second half of 2021 and widely linked to Vietnam-based operators, it targets individuals and organizations likely to manage Meta advertising assets, especially marketing, digital media, managerial, and HR personnel.

Ducktail is best known for stealing browser cookies and abusing already authenticated Facebook sessions rather than relying solely on credential theft. It enumerates installed browsers, extracts browser data and Facebook session material, and uses the victim’s own machine and session context to interact with Facebook services and APIs in a way intended to appear legitimate. When it identifies access to a Facebook Business account, it attempts account takeover actions such as adding attacker-controlled email addresses with high-privilege business roles, enabling persistent control over advertising assets and abuse of ad spend.

Observed Ducktail variants have been implemented in multiple forms, including .NET Core single-file executables, Delphi-based samples, malicious browser-extension workflows, and LNK-triggered PowerShell chains. The malware commonly includes anti-analysis checks, browser and system reconnaissance, and exfiltration through Telegram. Some campaigns also used decoy documents or media to mask execution and improve social-engineering success.

Delivery has centered on highly targeted social engineering. Operators have used fake LinkedIn recruiter personas, job-offer lures, direct messages, and follow-on archive downloads aimed at professionals likely to hold advertising privileges. Additional distribution has used phishing emails, fake websites impersonating marketing or AI-related tools, cloud-hosted archives, and LNK-based lure packages. Campaigns have also used spoofed branding, fake document icons, and decoy files to increase credibility.

The operation’s objective is primarily monetization through takeover and abuse of Facebook Business and Ads accounts, including malvertising and related advertising fraud. Ducktail is frequently discussed alongside other Vietnam-linked ad-account theft malware families, but it remains distinct for its focused abuse of Facebook business sessions and role-management workflows.

Capabilities

Defense Evasion
Exfiltration
Reconnaissance
Session Hijacking
Spoofing

Samples

Recent samples

1 sandbox sample in the Derp library, newest 1 shown

5e7fec38e55f7a8faeb8d4483e5ba741294169a56da3c4d884761f4494a8ab7f

Analysed Oct 6, 2026Triage report

MITRE ATT&CK

DuckTail in ATT&CK

41 distinct techniques

Techniques

41 techniques

T1059.001 PowerShell T1560 Archive Collected Data T1566 Phishing T1036 Masquerading T1102 Web Service T1584 Compromise Infrastructure T1583.001 Domains T1566.003 Spearphishing via Service T1176 Software Extensions T1027.001 Binary Padding T1566.002 Spearphishing Link T1539 Steal Web Session Cookie T1588.003 Code Signing Certificates T1027 Obfuscated Files or Information T1566.001 Spearphishing Attachment T1567 Exfiltration Over Web Service T1620 Reflective Code Loading T1589 Gather Victim Identity Information T1057 Process Discovery T1204.002 Malicious File T1083 File and Directory Discovery T1070.004 File Deletion T1598.002 Spearphishing Attachment T1132.001 Standard Encoding T1012 Query Registry T1622 Debugger Evasion T1016.001 Internet Connection Discovery T1129 Shared Modules T1041 Exfiltration Over C2 Channel T1071.001 Web Protocols T1587.001 Malware T1098 Account Manipulation T1078 Valid Accounts T1555.003 Credentials from Web Browsers T1102.002 Bidirectional Communication T1593.001 Social Media T1586.001 Social Media Accounts T1591 Gather Victim Org Information T1105 Ingress Tool Transfer T1136 Create Account T1021.001 Remote Desktop Protocol