Unmasking the DarkCloud: A New Stealer Is Hiding Malware in JPG Files

According to CyberProof, MDR analysts observed a sharp increase in DarkCloud Stealer infections, with campaigns primarily targeting financial organisations through phishing emails carrying malicious RAR attachments. The initial access vector was a phishing email containing an attachment named Proof of Payment[.]rar, which, when opened, launched a malicious VBE script that decoded base64 content downloading a JPG file (universe-1733359315202-8750[.]jpg).

Hidden within the image was the DarkCloud Loader, a .NET DLL extracted and executed using PowerShell; the loader then persisted by copying JavaScript files and creating registry run keys before downloading and executing the main stealer payload that runs in memory and injects into MSBuild.exe. The DarkCloud Stealer later reinforced persistence with a new entry—M3hd0pf.exe on every user login—after injection, and sought credentials from major web browsers such as Chrome and Edge as well as FTP and email clients.

Exfiltration occurred via FTP and SMTP, with data sent to domains generated by a Domain Generation Algorithm, including blurred endpoints such as blurjbxy[.]shop, financialsecured[.]xyz, and wizwig[.]biz.