Dark Cloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs Auto It
Summary: In January 2025, Unit 42 researchers identified a series of attacks distributing DarkCloud Stealer, with the latest chain using AutoIt-compiled executables and a file-sharing server to host the malware. The stealer, advertised on hacking forums since January 2023 and spotted in the wild since 2022, targets browser credit card data, login credentials and other personal data, and has notably focused on government organizations, with a February 2025 report noting attacks against machines in Poland.
What's compelling: DarkCloud's AutoIt dropper decompresses and decrypts its bytecode at runtime and hides a shellcode loader behind a 9168-byte offset, which is why Unit 42 says traditional signature-based detection struggles with it - and the campaign's focus on government organizations means public-sector credentials and browser-stored card data are the prize.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026