Title: Evolving Tactics: Threat Group Shifts to Phishing With DarkMe in 2026 Campaign
In a noteworthy development within cybersecurity, a threat group previously known for exploiting undiscovered vulnerabilities in WinRAR and Windows has made a significant tactical shift. This group now employs a more straightforward method: sending phishing emails containing links that appear to lead to images. Recent research from Huntress sheds light on a campaign initiated in 2026 that delivers DarkMe, a remote access trojan (RAT) historically associated with Water Hydra and also tracked as DarkCasino.
The attacker group gained notoriety in 2023 and 2024 after successfully weaponizing two zero-day vulnerabilities: CVE-2023-38831 in WinRAR and CVE-2024-21412 in Windows Defender SmartScreen. These attacks primarily targeted foreign exchange traders, indicating a shift toward exploiting financial service professionals. However, in this latest campaign, the group has abandoned sophisticated exploits in favor of a more deceptive method that targets unsuspecting email users.
Victims of this new scheme receive emails that contain links disguised as images. Instead of leading to a picture, these links download a file named image.pif—essentially a Windows program cloaked in the illusion of a harmless image file. What makes this tactic particularly concerning is that the downloaded file is disguised with forged details suggesting it originates from a purported security product called “Aegis Sentinel.” Once a user double-clicks this deceptive file, it surreptitiously initiates a sequence of operations, pulling down a Windows installer package from a remote server, thus paving the way for infection.
A Complex Multi-Stage Infiltration
Following the initial download, the malware engages in a sophisticated multi-stage chain designed to remain undetected. The infection process proceeds through three heavily obfuscated loaders crafted in Visual Basic 6. A critical part of this process is a verification mechanism that scans the machine for 329 different applications. This check ensures that the malware is running on a legitimate, operational computer rather than in a controlled environment set up by researchers or cybersecurity professionals.
It is only after this verification process that the final payload gets injected into clspack.exe—a legitimate Microsoft program that boasts a valid digital signature. This clever tactic allows the malware to masquerade its activities under the guise of a trusted process, making it harder to detect and neutralize.
Huntress characterizes this evolution as a transition for DarkMe, shifting from being an advanced persistent threat tool to a more conventional information-stealing entity. This pivot highlights the increasing adaptability of cybercriminals, who are shifting their strategies to simpler methods that exploit human psychology rather than relying solely on technical exploits.
Vulnerabilities in the Attackers’ Code
Interestingly, Huntress researchers also uncovered flaws within the attackers’ own coding. Specifically, the payload of DarkMe is protected with an encryption method that was intended to be RC4. However, due to an incomplete implementation—the cipher setup skips a critical step—the encryption collapses into a predictable pattern after only a few bytes. Previous public reports mischaracterized this routine as simple XOR encoding, and Huntress’s analysis brings new clarity to this misunderstanding, providing a deeper insight into the attackers’ techniques.
Moreover, the research team identified not just a new encryption key but also a new command-and-control domain utilized throughout the campaign. Alongside this valuable information, Huntress has published detection rules, indicators of compromise, and remediation guidance to assist organizations in mitigating risks associated with these types of threats.
A Trend Towards Social Engineering
The findings from this research resonate with a broader trend observed among well-resourced attackers, who increasingly favor social engineering tactics over complex and costly exploitation of vulnerabilities. This trend emphasizes the importance of considering the human dimension of cybersecurity. Huntress’s guidance highlights this need, advising users to approach unusual file types arriving via email with a healthy dose of skepticism. Furthermore, it strongly recommends monitoring legitimate Windows tools to prevent unauthorized software downloads from the internet.
This research serves as a timely reminder that as attackers evolve their tactics, defenders must remain vigilant, not just in technical defenses but also in educating users on recognizing and reporting suspicious activities. In the ever-changing landscape of cybersecurity threats, awareness and adaptability will be key to safeguarding sensitive data and ensuring network integrity.