The malicious email pointing to the first stage downloader for DarkMe (Source: Huntress)<\/p>\n The link supposedly points to a PNG file, but clicking on it triggers the download of image.pif, a Windows executable.<\/p>\n From fake image file to full-blown RAT<\/p>\n Huntress, a cybersecurity company that pairs its own security software with a 24\/7 human-led SOC, says that the same binary was delivered to two of its customers\u2019 envrionments. <\/p>\n \u201cThe users simply double-clicked and downloaded the file, not realising what it was,\u201d they noted. \u201cModern Windows systems execute .pif files as a program, regardless of what the extension implies (or what the icon shows).\u201d<\/p>\n The execution started a chain of additional downloads and executions, script running, deployment of components, DLL invocations, and code injection.<\/p>\n \u201cThe command that initiates the final stage of infection, rundll32.exe \/sta {CFDC57BA-1705-45AF-BA10-EFC3D592982B}, was observed in the 2024 campaign, and is a great signature to detect or hunt on,\u201d the analysts pointed out.<\/p>\n A final chain of loaders tests the system for presence of many different applications: from Slack and Discord, Zoom and WhatsApp, password managers, trading terminals, online poker clients, cryptowallets, VPN clients, gmae laungers, Spotify, browsers, PDF readers, and OEM and peripheral support utilities.<\/p>\n \u201cThat last category reframes the whole list. Gaming-mouse configuration utilities and RGB lighting daemons hold nothing of value, but they do prove that a human being uses this computer,\u201d they explained.<\/p>\n \u201cExecution stops when none of the 329 are found. This is not a target list; it is an inverted sandbox check. A conventional evasion check looks for analysis tooling and bails when it finds it, but this list contains no analysis tools. Rather than asking \u201cam I being watched?\u201d, DarkMe asks whether anyone actually uses this system.\u201d<\/p>\n Then comes the creation of registry values to assure persistence, the profiling of the system, the process hollowing, and the final payload: DarkMe, a Visual Basic 6 RAT and infostealer that goes after crypto-wallets and can take screenshots.<\/p>\n Who\u2019s behind these attacks?<\/p>\n Andrew Brandt, Principal Threat Intelligence Incident Commander at Huntress, told us that they can\u2019t confirm that this attack was carried out by Water Hydra (aka DarkCasino), the threat group associated with the 2024 attacks documented by Trend Micro<\/a> and SonicWall. <\/p>\n \u201cWe do have some clues about the malware\u2019s possible origins. For example, the Spanish localization property in the compiled DLLs suggests that the developer may be a Spanish national or living in Spain,\u201d he noted. <\/p>\n \u201cAs for motivation, the activity appears to be financially driven, though the actors also seem willing to target children for things like Roblox Robux or Steam and Epic Games registration keys.\u201d<\/p>\n He also said that, at this point, they don\u2019t know whether DarkMe is being offered as-a-Service to cybercriminals willing to pay for it.<\/p>\n Unfortunately, he wasn\u2019t able to share details about Huntress\u2019 customers that were affected, but the shift in targeting from niche forex traders to everyday corporate users is apparent.<\/p>\n \u201cWe are watching threat actors pivot from highly skilled, targeted intrusions toward high-volume, low-effort attacks and the results speak for themselves. In 2026, users are still clicking links in unsolicited emails. As long as these old-school phishing tactics keep working, adversaries have no reason to burn expensive exploits,\u201d Brandt and colleague James Northey concluded<\/a>.<\/p>\n They additionally shared indicators of compromise associated with this campaign, and advised on how to catch the infection, contain it and clean it.<\/p>\n![\"DarkMe](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/09\/darkme-email.webp\" "\\"The")
<\/a><\/p>\n![](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2026\/09\/devider.webp\"\/)
<\/p>\n