ThreatLabz

**Executive summary:** This report describes the DuckTail campaign in which attackers impersonate recruiters and companies on LinkedIn and spoof marketing/AI tools to socially engineer marketing professionals into downloading cloud-hosted malicious archives (commonly .NET executables or add-ins) that include decoy documents, employ valid code-signing certificates at times, use URL shorteners and custom domains, and communicate via Telegram for C2; the document enumerates distribution methods, hosting patterns, decoy artifacts, and points to an IOC section.