DarkCloud

DarkCloud is a Windows information-stealing malware family first observed in 2022 and commonly sold as a low-cost commodity stealer through criminal marketplaces and Telegram. It is typically implemented in Visual Basic 6 and has appeared in multiple versions, including a rewritten v4.2 variant. DarkCloud is primarily used to harvest credentials and other sensitive data from infected systems, targeting web browsers, email clients, FTP clients, communication tools, and cryptocurrency-wallet-related data.

DarkCloud’s collection scope includes saved browser usernames and passwords, cookies, credit card and other browser-stored financial data, email client information and contacts, FTP credentials, screenshots, keystrokes, clipboard contents, documents, and system information. Reported targets include Chromium-based browsers, Firefox-based browsers, Outlook, Thunderbird, FoxMail, FileZilla, CoreFTP, WinSCP, and other locally stored application data sources. Some variants use bundled SQLite-related components to access browser credential databases and may query browser data stores directly to extract login and payment information.

The malware is most often delivered through phishing and spam campaigns using compressed attachments and lures themed as invoices, quotes, payment statements, shipment notices, or financial correspondence. Observed infection chains also include JavaScript, PowerShell, JAR, BAT, VBS, AutoIt, and .NET-based loaders, as well as multi-stage delivery using steganography or embedded payloads. DarkCloud has also been reported in campaigns involving malvertising, watering-hole activity, infected websites, and cracked-software-style lures, though phishing remains the most consistently documented vector. It is frequently delivered by intermediary loaders and crypter-like chains, and has been observed alongside other malware families such as ClipBanker, Agent Tesla, AsyncRAT, Remcos, XWorm, SmokeLoader, and payloads delivered by PhantomVAI/PanthomVAI-style loaders.

Execution and persistence behavior varies by campaign and version. Documented techniques include copying itself into user-accessible directories, establishing autorun through Run or RunOnce mechanisms, creating Startup-folder scripts, and scheduled-task persistence. Several campaigns used process hollowing or process injection into legitimate Windows processes such as MSBuild or svchost to execute the final stealer while reducing visibility. Anti-analysis and defense-evasion features include heavy string obfuscation or encryption, staged decryption, runtime loading, checks for analysis tools, and in some cases delaying activity until keyboard or mouse interaction is detected.

Exfiltration is flexible and commonly uses multiple simultaneous channels. Reported methods include SMTP email, Telegram bot communications, FTP upload, HTTP POST, and PHP-based web panels. This multi-channel design improves resilience when one exfiltration path is blocked. DarkCloud has been used in campaigns targeting both individuals and enterprises, with manufacturing among the specifically reported victim sectors. As a commodity infostealer with broad credential and data theft capability, DarkCloud can support follow-on intrusion activity including account compromise, fraud, phishing, and broader post-compromise operations.