DarkMe (Malware): news timeline & CVEs

Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents

Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.

Helpfeel confirmed that hackers exploited a Gyazo server flaw and stole 23.6 million user records. The same weekly digest details TASK#STOMP, a Windows backdoor that uploads business documents and also takes Wi-Fi passwords, clipboard text, and screenshots. A Chinese-speaking actor exploited CVE-2026-7273 on 996 unpatched Zyxel GS1900 switches in 48 countries, and Check Point said CVE-2026-93616 has been exploited since July 23, 2026. Elsevier domains were briefly redirected to a LAPSUS$ page, while DarkMe is now spread by ordinary phishing email.

Help Net Security08:00 UTC · 1h agoData breach in the wildCVE-2026-7273 CVE-2026-85102 CVE-2026-93616

DarkMe RAT trades zero-days for plain phishing emails

The DarkMe RAT has shifted from using zero-day exploits to simple phishing emails, targeting corporate users to steal cryptocurrency and credentials.

The DarkMe RAT, previously linked to Water Hydra (DarkCasino) and financial traders, is now being distributed through simple phishing emails to corporate targets. Instead of using zero-day exploits, attackers send a link to a malicious .pif file disguised as an image. The malware executes a complex chain, performs an inverted sandbox check by looking for common user applications, and ultimately deploys a Visual Basic 6 RAT and infostealer focused on cryptocurrency wallets and credentials.

Help Net SecuritySep 23, 13:24 UTC · 3d agoMalware in the wild 2 sources

[object Object]

The DarkMe malware is now being delivered via simple phishing emails, abandoning the zero-days previously used to deliver the payload.

Huntress researchers report a new DarkMe malware campaign that has abandoned zero-day exploits in favor of simple social engineering. The attack begins with a phishing email delivering a .pif file disguised as an image, which uses msiexec to fetch a remote MSI installer. This installer unpacks a VB6-based malware chain that executes via a COM object registered through rundll32.exe, a technique observed in prior Water Hydra campaigns. The shift to less sophisticated initial access methods indicates a trend of broadening target lists.

Huntressupdated Sep 23, 13:24 UTC · 3d agofirst Sep 22, 21:00 UTC · 4d agoMalware in the wild 2 sources1

DarkMe

Timeline3 articles

Related CVEsby mentions

Appears with

Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents

DarkMe RAT trades zero-days for plain phishing emails

[object Object]