DarkCloud Infostealer Emerges as Major Threat With Scalable Credential Theft Targeting Enterprises

DarkCloud is a commercial credential‑harvesting infostealer sold on Telegram and a clearnet storefront that targets major browsers, email clients, FTP/VPN clients and contact lists to harvest credentials, cookies and payment data; it stages stolen data under %APPDATA%\Microsoft\Windows\Templates and exfiltrates via SMTP, FTP, Telegram or HTTP. The malware is written using VB6 runtime components compiled into native code to evade detection and uses a deterministic VB PRNG-based string obfuscation to frustrate analysis; Flashpoint links it to an earlier BluStealer/A310LoggerStealer project. Recommended mitigations include strict email attachment filtering, monitoring for abnormal exfiltration, credential rotation, enterprise password management, and EDR coverage for legacy VB6 runtimes.