Tag: darkcloud stealer

2 Attack Reports | 0 Vulnerabilities

Attack reports

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

Unit 42 researchers have observed changes in the distribution and obfuscation techniques of DarkCloud Stealer. The new infection chain, first seen in April 2025, involves ConfuserEx obfuscation and a final payload written in Visual Basic 6. The attack begins with a phishing email containing an arch…

infection chain

process hollowing

darkcloud stealer

Published: August 8, 2025

Downloadable IOCs: 10

DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt

Unit 42 researchers have identified a series of attacks distributing DarkCloud Stealer, an information-stealing malware that has been active since 2022. The latest attack chain incorporates AutoIt to evade detection and uses a file-sharing server to host the malware. The infection process begins wi…

credential theft

information stealing

multi-stage payload

darkcloud stealer

Published: May 14, 2025

Linked vulnerabilities : CVE-2025-31324 (CVSS 10.0)

Downloadable IOCs: 4

Click here to see more Attack Reports