DarkMe RAT trades zero-days for plain phishing emails
The DarkMe RAT has shifted from using zero-day exploits to simple phishing emails, targeting corporate users to steal cryptocurrency and credentials.
The DarkMe RAT, previously linked to Water Hydra (DarkCasino) and financial traders, is now being distributed through simple phishing emails to corporate targets. Instead of using zero-day exploits, attackers send a link to a malicious .pif file disguised as an image. The malware executes a complex chain, performs an inverted sandbox check by looking for common user applications, and ultimately deploys a Visual Basic 6 RAT and infostealer focused on cryptocurrency wallets and credentials.
- DarkMe RAT is now distributed via simple phishing emails instead of zero-day exploits.
- Attackers use a malicious .pif file disguised as a PNG image.
- The malware performs an inverted sandbox check by looking for user applications.
- DarkMe targets crypto wallets, credentials, and takes screenshots.
- The campaign targets everyday corporate users, not just financial traders.
Full article644 words · extracted from helpnetsecurity.com · click to collapse
DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users, has been spotted again.
This time around, its distribution has been simplified: instead of leveraging zero-day exploits, attackers are betting on a simple email to convince targets to run it on their machine:
The malicious email pointing to the first stage downloader for DarkMe (Source: Huntress)
The link supposedly points to a PNG file, but clicking on it triggers the download of image.pif, a Windows executable.
From fake image file to full-blown RAT
Huntress, a cybersecurity company that pairs its own security software with a 24/7 human-led SOC, says that the same binary was delivered to two of its customers’ envrionments.
“The users simply double-clicked and downloaded the file, not realising what it was,” they noted. “Modern Windows systems execute .pif files as a program, regardless of what the extension implies (or what the icon shows).”
The execution started a chain of additional downloads and executions, script running, deployment of components, DLL invocations, and code injection.
“The command that initiates the final stage of infection, rundll32.exe /sta {CFDC57BA-1705-45AF-BA10-EFC3D592982B}, was observed in the 2024 campaign, and is a great signature to detect or hunt on,” the analysts pointed out.
A final chain of loaders tests the system for presence of many different applications: from Slack and Discord, Zoom and WhatsApp, password managers, trading terminals, online poker clients, cryptowallets, VPN clients, gmae laungers, Spotify, browsers, PDF readers, and OEM and peripheral support utilities.
“That last category reframes the whole list. Gaming-mouse configuration utilities and RGB lighting daemons hold nothing of value, but they do prove that a human being uses this computer,” they explained.
“Execution stops when none of the 329 are found. This is not a target list; it is an inverted sandbox check. A conventional evasion check looks for analysis tooling and bails when it finds it, but this list contains no analysis tools. Rather than asking “am I being watched?”, DarkMe asks whether anyone actually uses this system.”
Then comes the creation of registry values to assure persistence, the profiling of the system, the process hollowing, and the final payload: DarkMe, a Visual Basic 6 RAT and infostealer that goes after crypto-wallets and can take screenshots.
Who’s behind these attacks?
Andrew Brandt, Principal Threat Intelligence Incident Commander at Huntress, told us that they can’t confirm that this attack was carried out by Water Hydra (aka DarkCasino), the threat group associated with the 2024 attacks documented by Trend Micro and SonicWall.
“We do have some clues about the malware’s possible origins. For example, the Spanish localization property in the compiled DLLs suggests that the developer may be a Spanish national or living in Spain,” he noted.
“As for motivation, the activity appears to be financially driven, though the actors also seem willing to target children for things like Roblox Robux or Steam and Epic Games registration keys.”
He also said that, at this point, they don’t know whether DarkMe is being offered as-a-Service to cybercriminals willing to pay for it.
Unfortunately, he wasn’t able to share details about Huntress’ customers that were affected, but the shift in targeting from niche forex traders to everyday corporate users is apparent.
“We are watching threat actors pivot from highly skilled, targeted intrusions toward high-volume, low-effort attacks and the results speak for themselves. In 2026, users are still clicking links in unsolicited emails. As long as these old-school phishing tactics keep working, adversaries have no reason to burn expensive exploits,” Brandt and colleague James Northey concluded.
They additionally shared indicators of compromise associated with this campaign, and advised on how to catch the infection, contain it and clean it.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!