A new variant of the DarkCloud information-stealing malware has emerged, leveraging the AutoIt scripting language to bypass security tools and harvest sensitive credentials from infected systems. According to researchers at Palo Alto Networks’ Unit 42 threat intelligence team, DarkCloud v4 exploits AutoIt’s flexible scripting capabilities to compile malicious payloads into standalone executables. Palo Alto Networks analysts noted that the malware further obfuscates strings using Base64 and XOR encryption, while inserting “junk code” to confuse static analysis tools. Researchers at Palo Alto Networks identified that the malware’s impact has been severe: breaches linked to DarkCloud v4 have already compromised over 120,000 corporate and individual accounts, with stolen credentials sold on darknet markets. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Dubbed DarkCloud Stealer v4, the malware has targeted financial institutions, healthcare organizations, and e-commerce platforms across Asia and Europe since its initial detection in March 2025. Security experts warn that its novel use of legacy tools and obfuscation techniques poses significant challenges for traditional detection methods. Attack vectors include phishing campaigns disguised as invoice alerts, malicious advertising redirects, and fake software updates for popular productivity tools like Slack and Zoom. Security teams can hunt for compiled AutoIt executables (.a3x) or anomalous script-child processes originating from trusted applications. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. These executables mimic legitimate software processes, enabling the malware to evade heuristic analysis and sandboxing. The malware suspends the target process, replaces its memory with malicious code, and resumes execution-a technique captured in forensic memory dumps. Endpoint detection tools should prioritize behavioral analysis, such as unexpected process injections or rapid credential-access attempts. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 14:19:53 +0000