Facebook Malware News: If you use the Meta-owned social media app Facebook to connect with the world, there is a piece of alarming news that you should be aware of. Cybersecurity firm Kaspersky has detected a malware threat that hacks the Business accounts of people working in the top positions of Human Resources, Digital Marketing, or Social Media Marketing domains.
FB Account Hacking With Ducktail Works Like This
The hackers send malicious archives to the victims with theme-based images and videos on a particular topic. For instance, if the central theme is fashion, the archive may include photos and videos about clothing. Inside these folders are executable files hidden with a PDF icon and a long name to conceal the '.exe' extension. The names (which may range from 'price lists' to 'guidelines for candidates') are skillfully chosen so that the recipient clicks on them.
Also Read: Facebook Scam: 'Look Who Died' Messages Target Users; All You Need To Know
After opening this file, the PDF opens as desired without any traces of malicious activity. However, the script scans the shortcuts on Desktop, Start, Quick Launch toolbar and Chromium-based browsers. Once a shortcut is found in an Internet browser, it runs a code to install an extension on the compromised device.
Recommended For You
The hackers send malicious archives to the victims with theme-based images and videos on a particular topic. (Image:Unsplash)
"Five minutes later, the malicious script terminates the browser process, prompting the user to restart it using one of the modified shortcuts," the blog noted. After clicking the shortcut, the extension gets installed as a 'Google Docs Offline' replica. After installation, the extension monitors the opened tabs and sends the details to a C2 server.
Once a victim opens Facebook, "the malicious extension checks for Ads and Business accounts and then hijacks them," the report noted. The extension can also steal session cookies used to sign into accounts stored in the browser without verification. According to Securelist, cybercriminals attacked Indian profiles the most. Further, these attacks were detected in Pakistan, USA, Germany, Ukraine, Vietnam and more countries.
Facebook Account: How To Be Safe?
Kaspersky recommends that users must not download archives from unknown and suspicious links. Plus, users must check the file type before opening the media on their computer. While these documents might look harmless, the '.exe' extension is a sign it is malware. Plus, users must install reliable antivirus software on their workstations.