Windows SmartScreen Bypass Flaw Exploited to Drop DarkGate RAT

Trend Micro researchers observed a mid-January phishing campaign that abused Google DoubleClick open redirects and a Windows SmartScreen bypass (CVE-2024-21412) to deliver fake Microsoft .MSI installers and install the DarkGate RAT (version 6.1.7). DarkGate, a Delphi-based RAT sold as MaaS, includes info-stealing, keylogging, process injection, download-and-execute, and multiple evasions; actors used open redirects plus the SmartScreen bypass to evade defenses. Microsoft has patched CVE-2024-21412; recommended mitigations include applying the patch, user training to avoid installers from untrusted channels, and continuous monitoring of attack surface and assets.