DarkCloud Stealer Targets Financial Firms via Weaponized RAR Files

DarkCloud Stealer is described as targeting financial institutions, with August 2025 marking a dramatic surge in such attacks and a wave of phishing emails containing malicious RAR archives designed to prey on Windows users. According to CyberProof, the phishing emails lead to a multi-stage payload that siphons login credentials from email clients, FTP utilities, and web browsers, with EDR alerts later flagging process injection into MSBuild.exe.

Investigations uncovered a novel DarkCloud loader embedded within a JPEG file, retrieved via PowerShell after the VBE script decodes embedded base64 content. Exfiltration is conducted over both FTP and SMTP channels, with the stealer packaging credentials and browser artefacts into encrypted archives before dispatch.

The attack chain begins with an attachment named Proof of Payment[.]rar (SHA256: 0ebc9f70eba3c50c2e6be8307f25e7ca572b1a26a1c37af00b22549f6e0a8129), which after extraction leads to Proof of Payment[.]vbe (SHA256: 90eefdabd6f33de39071d4bfd540654bfdc60bff3198d5637f82e10b0cabd01d) executed via wscript.exe. persistence is achieved by registry Run keys to launch a JavaScript file and a masqueraded M3hd0pf.exe, with Domain Generation Algorithm–based C2 lookups to several ephemeral domains.