This threat report details the distribution and activity of multiple infostealer malware families during June 2026. Attackers used SEO poisoning to lure victims into downloading malicious EXE files (84.5%) and DLL side-loading payloads (15.5%), primarily hosted on Mediafire, Mega, and other cloud platforms. Microsoft Corporation was frequently impersonated to increase credibility. MacOS environments were targeted using ClickFix and malicious Bash scripts, with one variant leveraging Polygon blockchain smart contracts to dynamically retrieve command and control addresses. Email-based campaigns delivered AgentTesla and DarkCloud malware via compressed attachments, with both variants exfiltrating stolen data through SMTP. The compromised credentials are valuable for dark web trading and enable secondary attacks. No known exploits in the wild or vendor patches are applicable as this is malware distribution rather than a software vulnerability.

Successful infections result in credential theft and data exfiltration, enabling attackers to trade stolen information on dark web markets and conduct secondary attacks. The targeting of both Windows and MacOS platforms broadens the potential victim base. The use of blockchain smart contracts for C2 address retrieval complicates detection and takedown efforts. Impersonation of Microsoft increases the likelihood of victim trust and infection.

This is a malware distribution campaign rather than a software vulnerability; therefore, no patches are available or applicable. Organizations should focus on user awareness to avoid downloading software from untrusted sources, especially cracked or pirated software. Email filtering and attachment scanning can help detect and block AgentTesla and DarkCloud payloads. Monitoring for indicators of compromise such as the provided hashes and domains is recommended. Since no official vendor remediation applies, defensive measures should emphasize prevention and detection of these malware families.