New Windows-Based DarkCloud Stealer Attacking Computers to Steal Login Credentials and Financial Data

Fortinet analysts identified a sophisticated fileless variant of the DarkCloud infostealer distributed through phishing RAR attachments that execute a JavaScript dropper; the malware extracts an encrypted .NET DLL embedded inside a JPEG and loads it directly into memory. It employs process hollowing and anti-sandbox checks (GetAsyncKeyState), persists by copying a JS to C:\Users\Public\Downloads\edriophthalma.js and creating an HKCU Run registry entry, and harvests saved credentials and payment card data from major browsers using direct SQL queries against browser databases.