Loading feed…
IT Security Guru0 Hot0 comments3 min read
Zero-day hackers ditch exploits for a fake image file in new DarkMe campaign
A threat group previously known for exploiting zero-day flaws in WinRAR and Windows Defender SmartScreen has switched to a simpler phishing method for delivering the DarkMe remote access trojan, according to new research from Huntress. Victims receive an email link that appears to download an image but actually delivers a disguised Windows executable (image.pif) impersonating a security product called Aegis Sentinel. The malware runs through three obfuscated Visual Basic 6 loaders, checks for 329 applications to detect sandboxes, then injects its payload into a legitimate signed Microsoft process to evade detection. Huntress also found a flaw in the malware's RC4 encryption implementation that makes it predictable, correcting earlier reports that had misidentified it as simple XOR encoding. The researchers published new indicators of compromise, a new C2 domain, and remediation guidance.
Source: https://www.itsecurityguru.org/2026/09/23/zero-day-hackers-ditch-exploits-for-a-fake-image-file-in-new-darkme-campaign. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.
Recommended for you
Bình luận
Đang tải bình luận…
