DarkCloud Infostealer — Commercial VB6 Credential-Harvesting Malware (A310Logger/BluStealer Successor)
DarkCloud Infostealer (TL-2026-0765), also tracked as DarkCloud Stealer, is a high-severity malware campaign, first published 2026-06-10. It is attributed to Darkcloud Coder with medium confidence, affects Microsoft Windows, maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 44 indicators of compromise.
Key facts for TL-2026-0765
- Threat ID
- TL-2026-0765
- Also known as
- DarkCloud Stealer, DarkCloud, A310Logger successor
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution
- Darkcloud Coder
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- financial, banking, government, technology, manufacturing
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 44
Malware and tooling in DarkCloud Infostealer
Malware and tooling: Telegram Bot API (api.telegram.org)
DarkCloud is a commercially sold Windows infostealer, first observed in 2022 and written in Visual Basic 6.0, that performs high-volume credential harvesting and structured data exfiltration across browsers, email clients, FTP applications, Pidgin and NordVPN. It is distributed via Telegram and a clearnet storefront under subscription tiers starting at US$30 and is operated by the 'Darkcloud Coder' actor (formerly 'BluCoder').
How DarkCloud Infostealer works
DarkCloud is a subscription-based ('malware-as-a-service') Windows infostealer marketed since 2022 by an actor known as 'Darkcloud Coder' (previously the Telegram handle 'BluCoder'), and is the lineal successor to the A310Logger/BluStealer family — a link established through matching regular-expression and exfiltration code patterns. The final-stage stealer is compiled from Visual Basic 6.0 to native code and depends on the legacy MSVBVM60.DLL runtime; the VB6 lineage materially lowers detection rates relative to functionally equivalent C/C++ samples in multi-engine scanning.
The malware has used several distinct delivery and obfuscation chains. Earlier 2025 campaigns documented by Unit 42 delivered DarkCloud via phishing emails carrying RAR archives or decoy PDFs (a fake 'Adobe Flash Player' update lure) that lead to an AutoIt-compiled dropper. The AutoIt script carries two embedded blobs — 'iodization' (a shellcode container) and 'plainstones' (an XOR-encrypted PE) — extracts shellcode at offset 0x23D0, flips memory to PAGE_EXECUTE_READWRITE via VirtualProtect(), and runs it through CallWindowProc(); the shellcode decrypts and runs the VB6 payload in memory. A newer chain replaces AutoIt with obfuscated JavaScript/WSF retrieved from open directories, which pulls AES+Base64-encrypted PowerShell that drops a ConfuserEx-protected .NET loader; that loader injects the VB6 stealer into RegAsm.exe via process hollowing (RunPE).
Internally, DarkCloud encrypts most strings to frustrate static and dynamic analysis. Older variants use a layered scheme built on Visual Basic's Rnd() PRNG with a custom deterministic seed-reset algorithm, hex-encoded ciphertext and Base64-encoded keys; recent variants encrypt critical strings — regular expressions, registry paths, file extensions and Telegram API credentials — with RC4 using a unique key per ciphertext. The stealer enumerates analysis tooling (WinDbg, Fiddler, TCPView, Process Explorer, Process Monitor, Wireshark, VMware Tools) before executing.
Collection covers Chromium- and Gecko-based browsers (Chrome, Edge, Firefox, Brave, Opera, Yandex, Vivaldi) for saved logins, cookies and credit-card data; email clients (Outlook, eM Client, FoxMail, Thunderbird, 163Mail, MailMaster) for stored passwords and contacts; FTP clients (FileZilla, WinSCP, CoreFTP); plus Pidgin and NordVPN credentials. It also captures screenshots, host/username system information, and keystrokes via a secondary keylogger component. Staged data is written under %APPDATA%\Microsoft\Windows\Templates (a 'DBS' folder for copied databases and a '_' folder for parsed plaintext) before exfiltration over SMTP (TLS, hostname/username embedded in the subject, data as attachments), FTP, the Telegram Bot API, and HTTP — all using credentials hardcoded per build. Since early 2025 the operation has shown a marked surge against financial-sector organizations, with activity peaking in August 2025.
MITRE ATT&CK techniques used in TL-2026-0765
Collection
T1005 Data from Local System; T1113 Screen Capture; T1114 Email Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Credential Access
T1056 Input Capture; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1518 Software Discovery
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Persistence
T1547 Boot or Logon Autostart Execution
Initial Access
defense-impairment
Affected products and versions in DarkCloud Infostealer
- Microsoft — Windows
Vulnerable versions: all supported Windows desktop versions - Google / Mozilla / Microsoft / Brave / Opera / Yandex / Vivaldi — Web browsers (Chromium and Gecko based)
Vulnerable versions: Chrome; Edge; Firefox; Brave; Opera; Yandex; Vivaldi - Multiple — Email and FTP clients
Vulnerable versions: Outlook; eM Client; FoxMail; Thunderbird; 163Mail; MailMaster; FileZilla; WinSCP; CoreFTP; Pidgin
Remediation for DarkCloud Infostealer
Immediate actions
- Block the known C2 / staging indicators at the perimeter and DNS layer: 176.65.142.190, the catbox.moe and lovestoblog.com staging URLs, and the DGA-style C2 domains (blurjbxy.shop, dmetis.xyz, rangersorange.click, financialsecured.xyz, twenty777.shop, raiderrob.info, olinsautodiagnosis.net, wizwig.biz)
- Hunt for and revoke any credentials, cookies, FTP logins and saved passwords that could have been harvested from affected hosts; force password resets and invalidate active sessions
- Block or alert on outbound api.telegram.org Bot API traffic from non-sanctioned endpoints and quarantine hosts beaconing to it
- Quarantine hosts showing RegAsm.exe spawned by office/script processes or exhibiting RunOnce/Run autostart entries pointing at user-writable paths
Workarounds
- Disable the MSVBVM60.DLL-dependent legacy VB6 runtime where not required and alert on its loading by untrusted binaries
- Block inbound archive attachments (RAR/TAR/7Z) containing script files and decoy PDFs at the mail gateway
Longer-term hardening
- Deploy EDR with behavioral detection for process hollowing (RunPE) into RegAsm.exe and AutoIt/PowerShell loader chains
- Restrict execution of script interpreters (wscript, cscript, JS/VBE/WSF, AutoIt) via application control / WDAC and disable macros where feasible
- Enforce phishing-resistant MFA so harvested static credentials cannot be reused for account takeover
- Deploy egress filtering and SMTP/FTP DLP to detect credential archives leaving the network
Weaknesses (CWE) in DarkCloud Infostealer
CWE-522, CWE-256, CWE-319
Timeline of DarkCloud Infostealer
- DarkCloud first observed in the wild as a commercial VB6 infostealer, marketed by 'Darkcloud Coder' (formerly the Telegram handle 'BluCoder'); linked as successor to A310Logger/BluStealer via matching regex and exfiltration code patterns.
- Email-based DarkCloud distribution campaign active from January 2025, delivering the stealer through malicious archive attachments.
- Unit 42 documents a shifted delivery chain using obfuscated AutoIt scripting (embedded 'iodization' shellcode and XOR-encrypted 'plainstones' PE) and decoy PDF/RAR lures.
- Cyble publishes 'Decoding the Inner Workings of DarkCloud Stealer', documenting RC4 per-ciphertext string encryption, the %APPDATA%\Microsoft\Windows\Templates staging folders, and RunPE process hollowing into RegAsm.exe.
- Marked surge in DarkCloud activity against financial-sector organizations observed, delivered via phishing emails with malicious RAR attachments; campaign volume peaks this month.
- New infection chain reported (gbhackers, CyberProof, Ampcus Cyber): JavaScript/WSF from open directories pulls AES+Base64 PowerShell that drops a ConfuserEx-protected .NET loader injecting the VB6 stealer into RegAsm.exe via process hollowing.
- SC Media reports that DarkCloud infostealer attacks against financial organizations are on the rise, amplifying the finance-sector targeting findings.
- Flashpoint publishes a technical analysis detailing DarkCloud's VB6 string-encryption (Rnd() PRNG, RC4), MaaS subscription tiers from US$30, and multi-protocol exfiltration (SMTP/FTP/Telegram/HTTP).
Sources cited for DarkCloud Infostealer
- Understanding the DarkCloud Infostealer
- DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt
- DarkCloud Stealer Uses Novel Infection Chain and ConfuserEx Obfuscation Techniques
- From Phishing to Payload: How DarkCloud Stealer is Targeting Financial Organizations
- Decoding The Inner Workings Of DarkCloud Stealer
- Uncovering DarkCloud Infostealer Attacks on the Finance Sector
- DarkCloud infostealer attacks against financial organizations on the rise
Threats related to DarkCloud Infostealer
- Agent Tesla LATAM Operation — 18-Month Credential Theft Campaign Against Chilean Enterprises via .NET Reactor 6.x Loader & aspnet_compiler.exe Process Hollowing
- Multi-Stage NetSupport RAT Loader Using Layered Obfuscation (Decimal Arrays, AES, GZIP)
- Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico with Multi-Stage Loader and Email Spreader
- Alleged Huntress Insider Leaked Law Enforcement Communications to DevMan Ransomware Operation (DragonForce/Conti Lineage)
Detection coverage for TL-2026-0765
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0765 across Splunk SPL, Microsoft KQL and Sigma, covering 44 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0765
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.