How to eliminate DUCKTAIL malware from the operating system

What is DUCKTAIL?

DUCKTAIL is the name of a malicious program designed to steal Facebook Business accounts. The observed attacks have been highly targeted.

Research by WithSecure Intelligence suggests that this malware has been around since 2021 and is associated with Vietnamese cyber criminals. At the time of writing, DUCKTAIL continues to receive updates, including new abilities to evade Facebook's security measures.

DUCKTAIL malware overview

At the time of writing, DUCKTAIL's campaigns have been highly individualized. The cyber criminals behind this malware search Facebook's Business/Ads platform for targets of interest and go after high-ranking individuals.

The goal is to gain access to accounts of victims who have significant or total control over a Facebook business page. For example, DUCKTAIL's ideal victims would have either Admin access or a Finance editor role. The former allows full control over the business account like deletion and management (e.g., settings, privileges, roles, tools, etc.). While hijacking the latter would enable the cyber criminals to view financial data (e.g., transactions, invoices, spending, payment methods, credit cards, etc.) and abuse it.

Following successful infiltration, DUCKTAIL begins its operation by checking for installed browsers, specifically looking for Google Chrome, Mozilla Firefox, Microsoft Edge, or Brave. From that point, the malware seeks to identify cookie paths and extract those relating to Facebook sessions.

These cookies can contain data necessary for the malware to gain access to the victim's Facebook account, but the malicious program gathers any relevant information it can find - including any and all security credentials.

DUCKTAIL also checks whether 2FA (two-factor authentication) is required - if it is - the program tries to acquire the recovery codes. In addition to session cookies, the malware can extract access tokens, user agents, IP addresses (geolocations), 2FA codes, and so on.

DUCKTAIL usually steals the Business accounts through associated personal Facebook accounts. Information such as victims' user ID, name, birthday, and email - is of interest to this program. The malware adds the emails in possession of the cyber criminals to Facebook Business accounts - thus establishing control over them.

Once an associated business/ad account is breached, DUCKTAIL collects the following data: name(s), verification status(es), connected account number, ad spending and payment cycles, ad account permissions, set currency, pending users, owners, member roles, linked emails, client data, and so forth.

To summarize, DUCKTAIL infections can result in severe privacy issues, significant financial losses, and identity theft. If you suspect that your device is infected with DUCKTAIL (or other malware), we strongly advise using an anti-virus to remove it immediately.

And if you believe that your account(s) have been compromised - change the passwords and contact Facebook's official support without delay.

To ensure the safety of your accounts, we recommend choosing two-factor/multi-factor authentication when possible, using strong passwords, and selecting prudent access/privilege/privacy settings.

Threat Summary:

Name	DUCKTAIL virus
Threat Type	Trojan, password-stealing virus, banking malware, spyware.
Detection Names	F-Secure (Trojan:W32/DuckTail.D), Webroot (W32.Trojan.Ducktail), Full List Of Detections (VirusTotal)
Symptoms	Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Distribution methods	Infected email attachments, malicious online advertisements, social engineering, software 'cracks'.
Damage	Stolen passwords and banking information, identity theft, the victim's computer added to a botnet.
Malware Removal (Windows)	To eliminate possible malware infections, scan your computer with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. ▼ Download Combo Cleaner To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Information-stealing malware examples

We have analyzed thousands of malicious programs, including those that steal particular information like - YTStealer - that targets YouTube accounts, and FFDroider, DevilsTongue, Redox, Ducky - which aim to steal Facebook accounts amongst other data.

This type of malware can seek a wide variety of information, and these malicious programs can have different/additional functionalities. However, regardless of how malware operates - system infections endanger device and user safety. Hence, it is essential to eliminate all threats immediately upon detection.

How did DUCKTAIL infiltrate my computer?

As previously mentioned, DUCKTAIL infection chains are tailor-made for the potential victims. WithSecure Intelligence has noted instances where this malware was delivered via the LinkedIn business networking platform.

WithSecure Intelligence researchers have also observed the infectious files starting DUCKTAIL's infection chains being hosted on cloud services such as Dropbox, MediaFire, and iCloud. The files themselves were usually archives with (often generic) names relating to the targeted business.

Generally, malware is spread using phishing and social engineering techniques. Virulent files can be in various formats, e.g., archives (ZIP, RAR, etc.), executables (.exe, .run, etc.), Microsoft Office and PDF documents, JavaScript, and so on. When an infectious file is executed, run, or otherwise opened - the malware download/installation process is initiated.

The most commonly used malicious software distribution methods include: drive-by (stealthy/deceptive) downloads, attachments/links in spam mail, online scams, untrustworthy download sources (e.g., freeware and third-party websites, P2P sharing networks, etc.), malvertising, illegal program activation tools ("cracks"), and fake updates.

How to avoid installation of malware?

We advise against opening the attachments and links found in suspicious/irrelevant emails and messages since that can lead to a system infection. It is just as important to exercise caution when browsing - as fraudulent and malicious material usually looks legitimate.

We also recommend downloading from official and verified channels. Additionally, all programs must be activated and updated with tools provided by genuine developers, as illegal activation ("cracking") tools and fake updaters may contain malware.

We must emphasize the importance of having a reputable anti-virus installed and kept up-to-date. This software must be used to run regular system scans and to remove threats and issues. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Update 5 May, 2023 - Cyber criminals are currently spreading DUCKTAIL malware via malicious shortcut (.LNK) files and disguising them as PDF or other similar documents. These shortcuts are distributed using email spam campaigns. The malicious shortcut usually comes with an icon of PDF document in order to trick users into execution. Once opened, the shortcut stealthily downloads malware alongside with a random PDF document as a disguise.

Example of a malicious shortcut and its target:

Screenshot of the disguise PDF document downloaded by this shortcut:

Update November 9, 2023 – new campaigns spreading DUCKTAIL have been observed. These attacks aim to carry out identity theft. The operations rely on compromised LinkedIn accounts to send job offer messages to users. The campaigns heavily target Italian companies, particularly technology-oriented ones.

One of the known operations sought financial sector employees of said companies. In this scheme, the victim is contacted via LinkedIn regarding a job offer. Several messages later, they are sent a PDF file detailing the open position of Senior Manager at the EA (Electronic Arts) video game company.

Two links can be found in the document, one leading to a page imitating EA's official website. This is a phishing site presenting a candidate registration form that requires logging in.

The other link leads to the download of a ZIP archive (titled "Senior_Manager_EA_Sport.zip"; may vary) from the Microsoft OneDrive file hosting service. The archive contains three MP4 format video files and two executables bearing the Microsoft Word logo as their icon.

The executables are designed to initiate DUCKTAIL's infection chain. It is noteworthy that once launched, the malicious executables display a decoy PDF document relating to the job offer.

Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.

Quick menu:

• What is DUCKTAIL?
• STEP 1. Manual removal of DUCKTAIL malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with DUCKTAIL malware, should I format my storage device to get rid of it?

No, DUCKTAIL's removal does not necessitate such drastic measures.

What are the biggest issues that DUCKTAIL malware can cause?

DUCKTAIL specifically targets Facebook Business accounts. Therefore, the threats these infections pose include: compromise of various Facebook accounts (personal, business, ad, etc.), severe privacy issues, significant financial losses, and identity theft.

What is the purpose of DUCKTAIL malware?

Most malicious programs are used to generate revenue, and DUCKTAIL is not an exception. However, it is worth mentioning that malware can be released for testing purposes or to cause pointless mayhem for the attackers' amusement. Malware attacks can also be motivated by personal grudges and political/geopolitical reasons.

My accounts have been stolen, what should I do?

Firstly, change the passwords of all potentially compromised accounts without delay. Secondly, inform their official support. If you suspect that your personally identifiable, financial, or other vulnerable information has been exposed - immediately contact the corresponding authorities.

How did DUCKTAIL malware infiltrate my computer?

The most popular malware distribution methods include: drive-by downloads, spam emails and messages, dubious download channels (e.g., unofficial and free file-hosting websites, P2P sharing networks, etc.), online scams, illegal software activation ("cracking") tools, fake updates, and malvertising. Some malicious programs are also capable of self-spreading via local networks and removable storage devices (e.g., external hard drives, USB flash drives, etc.).

Will Combo Cleaner protect me from malware?

Yes, Combo Cleaner is designed to detect and remove threats. It can eliminate most of the known malware infections. However, it must be stressed that performing a complete system scan is paramount - since sophisticated malicious software tends to hide deep within systems.

▼ Show Discussion