New Spear-Phishing Attack Deploys DarkCloud Malware to Steal Keystrokes and Credentials

According to eSentire, a new spear-phishing campaign in September 2025 targeted a mid-sized manufacturer by delivering the DarkCloud infostealer to a Zendesk support inbox. The attackers used a banking-themed lure — “Swift Message MT103 Addiko Bank ad: FT2521935SVT” — and sent a malicious zip attachment named “Swift Message MT103 FT2521935SVT[.]zip,” containing DarkCloud version 3.2 (“Swift Message MT103 FT2521935SVT.exe”).

DarkCloud has evolved with features such as string encryption, sandbox evasion checks and an updated stub, and, once executed, it harvests browser passwords, credit cards, cookies, keystrokes, FTP credentials, clipboard contents, email contacts, files and cryptocurrency wallets, exfiltrating stolen data via Telegram, FTP, SMTP or PHP web panels.

The lure email, sent from procure@bmuxitq[.]shop, mimicked legitimate financial correspondence to avoid detection, with the campaign attempting to persuade analysts to enable the malware. In its technical analysis, DarkCloud’s VB6-based builder and obfuscated strings are used to reveal exfiltration credentials and C2 endpoints, while persistence relies on RunOnce registry entries.