Threats Tagged 'darkcloud'

In June 2026, multiple infostealer malware families including Remus, ACRStealer, LummaC2, and Vidar were actively distributed using SEO poisoning and disguised as illegal software. The primary infection vectors were EXE files and DLL side-loading, with distribution through popular cloud storage platforms. MacOS systems were targeted via ClickFix techniques and malicious Bash scripts, including a variant using Polygon smart contracts for dynamic command and control. Email campaigns spread AgentTesla and DarkCloud malware through compressed attachments, both exfiltrating data via SMTP. The stolen credentials from these campaigns pose significant risks for illicit trading and follow-on attacks.

This analysis covers infostealer distribution trends observed during May 2026, based on automated collection systems and diagnostic logs. Distribution occurred primarily through illegal software disguised as cracks and keygens, as well as email campaigns. ACRStealer, Remus, and LummaC2 were most prevalent, with distribution via domains including Mediafire and AWS S3 buckets. Microsoft was the most impersonated company, followed by Auslogics and NVIDIA. EXE files represented 78.9% of execution types, while DLL side-loading accounted for 21.1%. macOS environments saw ClickFix techniques and malicious Bash scripts, with 142 scripts and 12 C2 domains identified. Email campaigns distributed AgentTesla and DarkCloud. Remus showed significant growth, comprising 36% of distributions. LummaC2 remained the most prevalent overall variant.