Dark Caracal group might have refreshed its malware, researchers say

Dark Caracal is reportedly shifting from Bandook to Poco RAT in an espionage and financially-motivated phishing campaign across Latin America, with researchers detecting 483 Poco RAT samples between June 2024 and February; victims in Venezuela, the Dominican Republic and Chile received invoice-themed phishing attachments that redirected to legitimate cloud storage to deliver a credential-harvesting RAT capable of spying, executing commands and loading additional malware. The campaign reuses Bandook-like TTPs—blurred decoy documents, link shorteners and cloud-hosted payloads—indicating the group may be replacing older tooling while maintaining consistent operational methodology and mixed espionage/financial objectives.