‘Ducktail’ attempts to take over Facebook business accounts by targeting LinkedIn professionals

A new phishing campaign codenamed ‘Ducktail’ is underway, attempting to take over Facebook business accounts by targeting professionals on LinkedIn.

Ducktail’s operators have a narrow targeting scope and carefully select their victims.

The virus scans Chrome, Edge, Brave, and Firefox for browser cookies, collects system information, and eventually targets Facebook credentials.

WithSecure believes that the Ducktail operators’ motivation is financial, as they seek quick profits in an environment where detecting and stopping the fraud would take time.