SecuriTricks - darkgate

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate …

obfuscation

screenconnect

atomic macos stealer (amos)

lampion

2025-08-21

windows run dialog

Published: August 21, 2025

Downloadable IOCs: 10

Danabot: Analyzing a fallen empire

ESET Research shares insights into Danabot, an infostealer recently disrupted by law enforcement. The malware, tracked since 2018, evolved from a banking trojan to a versatile tool for data theft and malware distribution. Operated as a malware-as-a-service, Danabot offered features like data steali…

Published: May 25, 2025

Downloadable IOCs: 1

Operation Endgame 2.0

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos…

Published: May 23, 2025

Downloadable IOCs: 9

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

The Black Basta and Cactus ransomware groups have incorporated BackConnect malware into their attack strategies to maintain persistent control over compromised systems. The attackers use social engineering tactics, including email flooding and impersonation of IT support, to gain initial access. Th…

onedrive exploitation

Published: March 3, 2025

Downloadable IOCs: 0

WebDAV-as-a-Service: Uncovering the infrastructure behind Emmenhtal loader distribution - Sekoia.io Blog

The Emmenhtal loader, also known as PeakLight, operates in a memory-only manner, making it difficult to detect and analyse. It is primarily used to distribute other malicious payloads, including well-known infostealers that target sensitive information.

Published: September 19, 2024

Downloadable IOCs: 120

The Abuse of ITarian RMM by Dolphin Loader

This report explores how the Dolphin Loader, a malware-as-a-service loader, abuses the legitimate ITarian Remote Monitoring and Management (RMM) software to distribute various malware payloads. The loader leverages the built-in functionality of RMM tools, such as remote command execution and system…

Published: August 19, 2024

Downloadable IOCs: 24

Disarming DarkGate: A Deep Dive into Thwarting the Latest DarkGate Variant

This report analyzes a recent phishing campaign distributing a new DarkGate Remote Access Trojan variant. The malware leverages various obfuscation and anti-analysis techniques, including process hollowing, anti-VM checks, and encoding. It supports numerous malicious functionalities like ransomware…

rat

darkgate

2024-07-15

Published: July 15, 2024

Downloadable IOCs: 4

A Social Engineering Tactic to Deploy Malware

McAfee Labs uncovered a sophisticated social engineering technique, dubbed 'ClickFix,' for deploying malware such as DarkGate and Lumma Stealer. Victims are lured to compromised websites displaying error messages with instructions to paste scripts in PowerShell, facilitating malware downloads and e…

Published: July 15, 2024

Downloadable IOCs: 7

DarkGate: Dancing the Samba With Alluring Excel Files

This analysis delves into a DarkGate malware campaign from March-April 2024 that exploits Microsoft Excel files to retrieve malicious payloads hosted on public-facing SMB file shares. It sheds light on the evolving tactics of this threat, which creatively abuses legitimate tools and services for di…

Published: July 11, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 37

From Clipboard to Compromise: A PowerShell Self-Pwn

This intelligence report details a unique social engineering technique observed by Proofpoint researchers, leveraging users to copy and paste malicious PowerShell scripts to infect their computers. The threat actors TA571 and ClearFake activity cluster employ this method to deliver malware like Dar…

Published: June 17, 2024

Downloadable IOCs: 14

DarkGate again but... Improved?

The report details the latest developments surrounding the DarkGate remote access trojan, including its enhanced capabilities in version 6, the activities of its developer RastaFarEye, and an in-depth analysis of the malware's new features, execution chain, and supported commands. It highlights Dar…

Published: June 6, 2024

Downloadable IOCs: 313

DarkGate switches up its tactics with new payload, email templates

This analysis delves into a recent surge of malicious email campaigns by the DarkGate threat actor, employing novel tactics to distribute malware. These campaigns leverage a technique called 'Remote Template Injection' to bypass security controls and deceive recipients into executing malicious code…

Published: June 6, 2024

Downloadable IOCs: 12

Warning Against Phishing Emails Prompting Execution of Commands via Paste

This report details a phishing campaign distributing malicious HTML files through emails. The files prompt users to paste and run malicious PowerShell commands that initiate a multi-stage infection process. The campaign ultimately delivers the DarkGate malware, highlighting the importance of exerci…

Published: June 6, 2024

Downloadable IOCs: 15

From Document to Script: Insides of Campaign

This report examines a recent malicious campaign initiated via phishing emails, seemingly from 'QuickBooks,' prompting users to install Java. Clicking the embedded link leads to downloading a malicious JAR file. The JAR contains commands to fetch additional payloads, including an obfuscated AutoIt …

Published: May 17, 2024

Downloadable IOCs: 11

The Darkgate Menace: Leveraging Autohotkey & Attempt to Evade Smartscreen

This report details a novel infection chain associated with DarkGate malware, a Remote Access Trojan (RAT) that exploits the AutoHotkey utility and attempts to bypass Microsoft Defender SmartScreen. The infection begins with an HTML-based entry point or an XLS file, utilizing techniques such as dis…

microsoft defender smartscreen

xls file

Published: April 30, 2024

Downloadable IOCs: 15

Tag: darkgate

Attack reports

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

Danabot: Analyzing a fallen empire

Operation Endgame 2.0

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion

Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware

Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape

New Bumblebee Loader Infection Chain Signals Possible Resurgence

WebDAV-as-a-Service: Uncovering the infrastructure behind Emmenhtal loader distribution - Sekoia.io Blog

The Abuse of ITarian RMM by Dolphin Loader

Disarming DarkGate: A Deep Dive into Thwarting the Latest DarkGate Variant

A Social Engineering Tactic to Deploy Malware

DarkGate: Dancing the Samba With Alluring Excel Files

From Clipboard to Compromise: A PowerShell Self-Pwn

DarkGate again but... Improved?

DarkGate switches up its tactics with new payload, email templates

Warning Against Phishing Emails Prompting Execution of Commands via Paste

From Document to Script: Insides of Campaign

The Darkgate Menace: Leveraging Autohotkey & Attempt to Evade Smartscreen