# DarkCloud Infostealer — Commercial VB6 Credential-Harvesting Malware (A310Logger/BluStealer Successor)

> DarkCloud is a commercially sold Windows infostealer, first observed in 2022 and written in Visual Basic 6.0, that performs high-volume credential harvesting and structured data exfiltration across browsers, email clients, FTP applications, Pidgin and NordVPN. It is distributed via Telegram and a clearnet storefront under subscription tiers starting at US$30 and is operated by the 'Darkcloud Coder' actor (formerly 'BluCoder').

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0765
- **ID:** TL-2026-0765
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Darkcloud Coder
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DarkCloud is a subscription-based ('malware-as-a-service') Windows infostealer marketed since 2022 by an actor known as 'Darkcloud Coder' (previously the Telegram handle 'BluCoder'), and is the lineal successor to the A310Logger/BluStealer family — a link established through matching regular-expression and exfiltration code patterns. The final-stage stealer is compiled from Visual Basic 6.0 to native code and depends on the legacy MSVBVM60.DLL runtime; the VB6 lineage materially lowers detection rates relative to functionally equivalent C/C++ samples in multi-engine scanning.

The malware has used several distinct delivery and obfuscation chains. Earlier 2025 campaigns documented by Unit 42 delivered DarkCloud via phishing emails carrying RAR archives or decoy PDFs (a fake 'Adobe Flash Player' update lure) that lead to an AutoIt-compiled dropper. The AutoIt script carries two embedded blobs — 'iodization' (a shellcode container) and 'plainstones' (an XOR-encrypted PE) — extracts shellcode at offset 0x23D0, flips memory to PAGE_EXECUTE_READWRITE via VirtualProtect(), and runs it through CallWindowProc(); the shellcode decrypts and runs the VB6 payload in memory. A newer chain replaces AutoIt with obfuscated JavaScript/WSF retrieved from open directories, which pulls AES+Base64-encrypted PowerShell that drops a ConfuserEx-protected .NET loader; that loader injects the VB6 stealer into RegAsm.exe via process hollowing (RunPE).

Internally, DarkCloud encrypts most strings to frustrate static and dynamic analysis. Older variants use a layered scheme built on Visual Basic's Rnd() PRNG with a custom deterministic seed-reset algorithm, hex-encoded ciphertext and Base64-encoded keys; recent variants encrypt critical strings — regular expressions, registry paths, file extensions and Telegram API credentials — with RC4 using a unique key per ciphertext. The stealer enumerates analysis tooling (WinDbg, Fiddler, TCPView, Process Explorer, Process Monitor, Wireshark, VMware Tools) before executing.

Collection covers Chromium- and Gecko-based browsers (Chrome, Edge, Firefox, Brave, Opera, Yandex, Vivaldi) for saved logins, cookies and credit-card data; email clients (Outlook, eM Client, FoxMail, Thunderbird, 163Mail, MailMaster) for stored passwords and contacts; FTP clients (FileZilla, WinSCP, CoreFTP); plus Pidgin and NordVPN credentials. It also captures screenshots, host/username system information, and keystrokes via a secondary keylogger component. Staged data is written under %APPDATA%\Microsoft\Windows\Templates (a 'DBS' folder for copied databases and a '_' folder for parsed plaintext) before exfiltration over SMTP (TLS, hostname/username embedded in the subject, data as attachments), FTP, the Telegram Bot API, and HTTP — all using credentials hardcoded per build. Since early 2025 the operation has shown a marked surge against financial-sector organizations, with activity peaking in August 2025.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1056 Input Capture
- T1087 Account Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Understanding the DarkCloud Infostealer](https://flashpoint.io/blog/understanding-darkcloud-infostealer/)
- [DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt](https://unit42.paloaltonetworks.com/darkcloud-stealer-and-obfuscated-autoit-scripting/)
- [DarkCloud Stealer Uses Novel Infection Chain and ConfuserEx Obfuscation Techniques](https://gbhackers.com/darkcloud-stealer-uses-novel-infection-chain/)
- [From Phishing to Payload: How DarkCloud Stealer is Targeting Financial Organizations](https://www.cyberproof.com/blog/darkcloud-stealer-targets-financial-organizations/)
- [Decoding The Inner Workings Of DarkCloud Stealer](https://cyble.com/blog/decoding-the-inner-workings-of-darkcloud-stealer/)
- [Uncovering DarkCloud Infostealer Attacks on the Finance Sector](https://www.ampcuscyber.com/shadowopsintel/uncovering-darkcloud-infostealer-attacks-on-the-finance-sector/)
- [DarkCloud infostealer attacks against financial organizations on the rise](https://www.scworld.com/news/darkcloud-infostealer-attacks-against-financial-organizations-on-the-rise)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0765