New Spear-Phishing Attack Distributes DarkCloud Malware

A recently uncovered spear-phishing campaignleverages sophisticated social engineering techniques to distribute DarkCloud, a modular malware suite designed to collect keystrokes, extract FTP credentials, and gather system information.

See also: Signal phishing attacks target Ukrainian military

In the last month, targeted emails pretending to be legitimate software updates or corporate invoices have reached unsuspecting recipients across various sectors. These messages contain a malicious Microsoft Word attachment that, when opened, triggers a multi-stage infection chain.

Initial identification indicates that the malicious actors behind the campaign have invested significant effort in crafting persuasive messages, demonstrating a high level of operational security and technical sophistication. Shortly after the victim activates the macros in the document, a hidden Visual Basic for Applications (VBA) is executed, contacting a command and control (C2) server to download the next stage of the payload.

This payload, the DarkCloud loader, is capable of decompressing additional modular directly into memory, avoiding disk-based detection and complicating analysis. Analysts note that the loader checks for virtual machine tricks and sandboxing environments, delaying execution or aborting if analysis tools are detected.

eSentire researchers identified the keystroke logging component of DarkCloud within hours of the initial detection of the campaign. They observed the malware injecting a dynamic link library into common processes such as explorer.exe and svchost.exe , creating hooks into the keystroke APIs to capture user input. This approach ensures that every character typed—including credentials entered into web-based FTP clients—can be intercepted.

See also: New Phishing Attack Targets PyPI Administrators

The collected data is encrypted with a custom XOR algorithm and sent to the C2 infrastructure under the guise of legitimate HTTPS traffic, and is integrated with normal network flows. In addition to credential theft, DarkCloud exhibits advanced identification capabilities. It gathers system information—such as running processes, installed software, and open network connections—and transmits this metadata back to the attackers. This enriched information allows operators to tailor next steps, such as a file removal plugin or a screen capture component, to the victim’s environment.

Throughout the campaign, malicious actors move between modular components to maximize data collection while minimizing forensic traces.

The infection sequence begins with a decoy document containing a scrambled VBA macro. Once triggered, the macro executes the following sequence: once dcl.dll is loaded, it unpacks additional modules into memory. The loader uses a custom “chunked XOR” routine to decrypt embedded payloads, avoiding dumping executables to disk. This memory-based design allows DarkCloud to maintain persistence via a registry execution key, while its modular architecture supports the development of new features on demand.

See also: Lucid PhaaS with 17,500 Phishing Domains Impersonates 316 Brands

Combining a compelling spear-phishing lure with an invisible, in-memory loader and modular add-ons, DarkCloud represents a significant threat to organizations that rely on file transfers via FTP and unified endpoint protection solutions. Security teams must monitor anomalous HTTPS sessions to unknown hosts and use behavior analysis tools capable of detecting API hook injections. Continuous threat intelligence sharing and rapid incident response will be critical for countering DarkCloud's evolving tactics.