Do Son A new DarkCloud infostealer variant uses VB6 obfuscation and anti-analysis techniques to steal credentials and crypto wallets from MetaMask, Exodus, and more.
DarkCloud Stealer
A new report reveals a multi-stage phishing campaign distributing DarkCloud Stealer. The malware hides its loader in a JPG file and injects code into MSBuild.exe for stealth.
Unit 42 uncovers DarkCloud Stealer's new evasion tactics, including heavily obfuscated JavaScript/WSF loaders and a final VB6 payload that injects into RegAsm.exe to bypass detection.