Helsinki-based cybersecurity vendor WithSecure (formerly F-Secure Business) says it has discovered an operation, dubbed \u201cDUCKTAIL,\u201d that uses social media-based spear phishing attacks to gain access to Facebook Business accounts.The company said that it has \u201chigh confidence\u201d that a Vietnamese threat actor is behind the attacks, which aim malicious messages at LinkedIn users who are likely to have admin access to their companies\u2019 Facebook accounts. The threat actor also targets email addresses of potential victims directly.What makes the attack unique, according to WithSecure, is the infostealer malware component, which is designed specifically to gain access to Facebook Business accounts. Previous attacks targeting Facebook did not target Facebook Business accounts in particular.\u00a0 If a victim can be induced to open a malicious link, the malware scans the infected computer for browsers and extracts cookies that indicate authenticated Facebook sessions for use in gaining access to those accounts. Command and control is handled via the Telegram messaging service, using the Telegram Bot system, and private data is also sent back to the hacker in this way.Hacked accounts can provide the bad actor with a wealth of information, including 2FA codes, IP addresses and geolocation, financial details and credit card numbers, and much more. It can also compromise Facebook advertising accounts.Mohammad Kazem Hassan Nejad, a researcher for WithSecure, said that the malicious actor behind the DUCKTAIL attacks has been careful in selecting the malware\u2019s targets.\u201cWe believe that the DUCKTAIL operators carefully select a small number of targets to increase their chances of success and remain unnoticed,\u201d he said in a statement announcing the company\u2019s findings. \u201cWe have observed individuals with managerial, digital marketing, digital media, and human resources roles in companies to have been targeted.\u201dThe company has been tracking the DUCKTAIL attacks since earlier this year, and said that that the malware has been under continuous development since the second half of 2021, adding new feature sets as Facebook updates its security measures.According to WithSecure, Facebook\u2019s security has been stalwart enough to ward off many attacks that have been attempted over the years, but it and other social media networks remain tempting targets for bad actors, thanks to the near-universal userbase that such platforms provide.