Cybersecuritynews

DarkCloud Infostealer Targets Enterprises with Scalable Credential Theft

First seen 26 Feb 2026, 15:13 UTC • Gbhackers

•43.1

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

DarkCloud, a credential-harvesting malware first observed in 2022, has emerged as a significant threat to enterprises in 2026. This commercially available infostealer is capable of executing large-scale credential theft, affecting organizations that rely on digital infrastructures. Its low-cost nature makes it accessible, posing a serious risk to enterprise security.

How this analysis works

Timeline

2022-01-01

DarkCloud first observed

2026-02-26

DarkCloud identified as major threat in cybersecurity landscape

Attack Flow

9 entities, 9 inferred relationships (STIX 2.1).

Technique (2)

Malware
T1555.003 - Credentials From Web Browsers

Organization (1)

Outlook

Malware (2)

DarkCloud
DarkCloud Infostealer

Affected Platform (3)

EM Client
Microsoft Edge
Mozilla Firefox

Tool (1)

Google Chrome

Relationships

DarkCloud targets Outlook
DarkCloud Infostealer targets Outlook
Malware targets EM Client
Malware targets Microsoft Edge
Malware targets Mozilla Firefox
T1555.003 - Credentials From Web Browsers targets EM Client
T1555.003 - Credentials From Web Browsers targets Microsoft Edge
T1555.003 - Credentials From Web Browsers targets Mozilla Firefox
DarkCloud related to Google Chrome

Continue Reading

Lazarus Group Exploits Windows Zero-Day to Target Defense Sector Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign MonikerLink RCE Vulnerability in Outlook Exploited with PoC Release FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation EU Sanctions Russia Over Ongoing Cyber Espionage Campaign APT28 Exploits Vulnerable Routers for Global DNS Hijacking Campaign

DarkCloud Infostealer Targets Enterprises with Scalable Credential Theft

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading