In this talk we will uncover a Chinese ecosystem that uses three distinct malware families to target Facebook users and commit ad fraud. One of these families, SilentFade, compromised Facebook accounts and caused ad-fraud related damages.

These malware families were initially discovered in December 2018, when a suspicious traffic spike across a number of Facebook endpoints indicated a possible malware-based account compromise attack. Our investigation uncovered a number of interesting techniques used to compromise people with the goal to commit ad fraud. The attackers primarily ran malicious ad campaigns, often in the form of advertising pharmaceutical pills and spam with fake celebrity endorsements.

The attackers also created detection challenges. They cloaked their landing pages and made purchases appear valid by using the legitimate credit cards and PayPal accounts linked to the compromised user accounts. In December 2019, as a result of an extensive investigation, Facebook pursued legal action against the responsible parties.

Industry investigators are rarely able to see an end-to-end picture of credential compromise directly leading to abuse on a particular platform. However, in this talk we will provide that end-to-end picture. We will dive deep into the full attack cycle used by this actor group and look at the inner workings of the SilentFade malware, the exploit it relied on, its two malware cousins, the ads run from compromised accounts, and the cloaking elements they used to hide. We will also shed light on the challenges involved in detecting and remediating malware compromised accounts from the perspective of a web service that typically has no control over the compromised endpoints that access these Internet services.