DarkCloud Stealer: Comprehensive Analysis of a New Attack Chain That Employs AutoIt

Unit 42 identified a new AutoIt-based variant of DarkCloud Stealer (Jan–Feb 2025) that is distributed via phishing PDFs or RAR attachments hosted on public file-sharing services. The multi-stage chain uses an AutoIt-compiled dropper containing two encrypted data blobs (shellcode + XORed payload); the shellcode builds and executes the final DarkCloud PE in memory. The payload harvests browser, mail, FTP/SMTP credentials, screenshots and other sensitive data, employs anti-analysis checks and achieves persistence via RunOnce; the report includes sample hashes, the hosting URL and mitigation guidance.