Operation Duck Hunt: A Peak Behind The Curtain Of DuckTail

The talk looks at DuckTail, an infostealer first seen in mid-2022 that targets Facebook advertising and business accounts and also takes browser cookies and account details. Stolen data is packed into zip archives and sent out through the Telegram Bot API, which the speaker walks through with a live demo. Because the bot's update feed only keeps about a day of messages, the investigation relies on forwarding messages to rebuild a fuller timeline of a chat.

Investigators found that the operator, shown as the creator of the chats, made several mistakes. The first version sent unencrypted archives, and test runs on a personal machine exposed an email address tied to a domain registration in Vietnam. A later variant added screenshots of infected machines. Chat logs showed how victims were lured with fake LinkedIn job ads carrying executables disguised as image and document files, after which the operators took over Facebook business accounts to run their own ads and sell products through a drop-shipping store.

The developer's own machine held further clues, including a code-signing certificate bought to evade antivirus and a name and birth date seen in other places. The speaker notes that the same exfiltration method is used by widely known commodity stealers and by state-linked groups in Southeast Asia and Central Asia, so defenders should consider blocking the bot's domain on their networks. Some questions, such as whether the same person wrote the later variant, were left open.