DarkCloud – An Advanced Stealer Malware Selling Via Telegram To Steal Data From Windows

DarkCloud is a Windows-focused stealer first observed in 2022 that uses multi-stage, obfuscated loaders (including Base64 + TripleDES components) and injects into legitimate processes (e.g., svchost.exe, MSBuild) to stealthily harvest browser data, passwords, email/FTP credentials, cryptocurrency wallets, screenshots, and keystrokes; it is widely distributed via phishing campaigns (targeting HR), malvertising, watering holes, and is sometimes deployed alongside other malware, with data exfiltration performed through Telegram channels.