Loading story…
A significant increase in DarkCloud infostealer attacks targeting financial organizations was observed in August 2025. Attackers used phishing emails with malicious RAR attachments to deliver the malware, which employs steganography and process injection to evade detection and exfiltrate credentials. CyberProof recommends heightened vigilance for suspicious attachments and blocking outbound connections to uncommon TLDs used in these campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have reported a significant resurgence and evolution of the DarkCloud infostealer malware, which is now being actively distributed in new campaigns targeting organizations. The latest version, DarkCloud 4.2, was identified during an attempted attack on a manufacturing sector client in September 2025. This version of the malware has been completely rewritten in Visual Basic 6 (VB6), a change that introduces new obfuscation techniques and makes detection more challenging for traditional security tools. The malware is now being sold on a dedicated website and distributed via Telegram, indicating a shift in its distribution channels following the temporary takedown of the XSS cybercrime forum, which previously served as its marketplace. Researchers from eSentire’s Threat Response Unit (TRU) observed that the primary infection vector remains phishing emails, with recent campaigns using financial-themed lures and malicious compressed attachments to trick recipients into executing the malware. Once installed, DarkCloud is capable of stealing a wide range of sensitive information, including credentials, cryptocurrency wallet data, and contact lists, making it a potent threat for both individuals and organizations. The malware’s new VB6-based obfuscation techniques further complicate analysis and remediation efforts, as highlighted by security analysts. In addition to credential theft, the latest DarkCloud variant is specifically engineered to target and exfiltrate cryptocurrency wallet information, reflecting the growing trend of financially motivated cybercrime. The malware’s operators have also improved its persistence mechanisms, allowing it to evade detection and maintain access to compromised systems for extended periods. Security experts warn that the combination of advanced obfuscation, expanded data theft capabilities, and aggressive distribution tactics significantly increases the risk posed by DarkCloud. The campaign’s reliance on phishing underscores the continued importance of user awareness and robust email security controls. Researchers emphasize that organizations should update their endpoint protection solutions and monitor for indicators of compromise associated with DarkCloud. The rapid evolution of the malware, including its migration to new sales platforms and technical enhancements, demonstrates the adaptability of cybercriminals in response to law enforcement actions. The incident serves as a reminder of the persistent threat posed by infostealer malware and the need for continuous vigilance in defending against evolving attack techniques. Security teams are advised to review their incident response plans and ensure that detection rules are updated to account for the latest DarkCloud behaviors. The resurgence of DarkCloud also highlights the interconnected nature of the cybercrime ecosystem, where disruptions to one platform can quickly lead to the emergence of new distribution channels. Organizations are encouraged to share threat intelligence and collaborate with industry peers to stay ahead of rapidly changing malware threats. The ongoing development and aggressive marketing of DarkCloud suggest that it will remain a significant threat in the near future, particularly for sectors handling sensitive financial and personal data.
Jun 29, 2026
Multiple cybersecurity reports highlight a surge in both ransomware and infostealer malware activity targeting organizations worldwide in late 2025. Notably, Qilin ransomware targeted a South Korean semiconductor back-end firm and a private equity firm, while data from a South Korean online ticketing platform was sold on dark web forums. The French interior ministry also faced a data breach, with claims surfacing on BreachForums and a suspect subsequently arrested. These incidents underscore the persistent threat posed by ransomware groups, with attacks affecting critical infrastructure sectors such as manufacturing, healthcare, and finance. The November 2025 threat trend report details the prevalence of major ransomware groups like Clop, Akira, and Qilin, and provides statistics on affected industries and regions. In parallel, infostealer malware campaigns have intensified, with Phantom Stealer version 3.5 emerging as a sophisticated threat capable of extracting sensitive data such as passwords, browser cookies, and cryptocurrency wallet information. This malware often masquerades as legitimate software installers, employing advanced evasion and process injection techniques to avoid detection. The November 2025 Infostealer Trend Report notes that infostealers like ACRStealer, LummaC2, and Rhadamanthys are frequently distributed via cracked software and SEO poisoning. Additionally, phishing campaigns using purchase order-themed PDFs are being used to harvest business credentials and system information, which are then exfiltrated to attackers via Telegram for further exploitation or sale.
Jun 29, 2026
Threat actors are continuing to prioritize **credential theft** while using defensive and trusted services to evade detection. DomainTools reported a Microsoft 365 phishing operation that **weaponizes Cloudflare protections** (including *Turnstile* human verification) to block automated analysis and security crawlers, then selectively serves a credential-harvesting flow only to “clean” visitors. The infrastructure used additional gatekeeping such as IP reputation checks (including lookups via `api.ipify.org`), hardcoded blocks for security-vendor and cloud-provider ranges, and user-agent filtering that returns a fake `404` page to bots, with the theft logic hidden behind heavy obfuscation. Separately, Hunt.io documented **Operation Roundish**, assessed with medium-high confidence as aligned to **APT28 (Fancy Bear)**, after discovering an exposed open directory hosting a Roundcube exploitation toolkit used against Ukrainian targets (including `mail.dmsu.gov.ua`). The toolkit included XSS payloads, a Flask-based C2, and modules for credential harvesting, mail forwarding persistence, bulk email exfiltration, address book theft, and 2FA secret extraction, plus a Go-based Linux implant (`httd`) found on a compromised Ukrainian web application. In parallel reporting on credential-access tradecraft, Flashpoint analysis highlighted the low-cost **DarkCloud infostealer** (sold for about **$30**) that steals browser logins/cookies and other data and exfiltrates via common channels (email/FTP/Telegram/HTTP), while Aryaka Threat Labs described the **BlackSanta** campaign using steganographic lures and **BYOVD** techniques to disable EDR and enable stealthy data theft over HTTPS—underscoring that credential access and defense evasion remain common precursors to broader enterprise compromise.
Jul 1, 2026