DarkBlinders Hackers Use Fake Meeting App to Deploy Backdoor and Steal Government Data

DarkBlinders conducted a targeted cyberespionage campaign (Aug–Oct 2026) using a trojanized meeting app called StarkMeet and GitHub-hosted repositories for C2 and tasking; operators harvested credentials and exfiltrated at least 1 GB of government cloud data from confirmed victims in Kurdistan and Israel. The malware installs under %LOCALAPPDATA%\Microsoft\RuntimeBroker, achieves persistence via a renamed signed vshost.exe (RuntimeBroker.exe) and a Windows Run registry key, uses an embedded GitHub token for host registration, decrypts payloads with SHA-256-derived AES keys, and executes PowerShell within an internal runspace to reduce detection, with evidence of selective activation and ties to known APT clusters.