A threat group best known for exploiting previously unknown flaws in WinRAR and Windows has switched to a much simpler method: an email link to what appears to be an image.
New research from Huntress details a 2026 campaign delivering DarkMe, a remote access trojan (RAT) historically linked to Water Hydra and also tracked as DarkCasino. The group made headlines in 2023 and 2024 for weaponising two zero-days, CVE-2023-38831 in WinRAR and CVE-2024-21412 in Windows Defender SmartScreen, in attacks on foreign exchange traders.
This time, no exploit is involved. According to Huntress, victims receive a phishing email containing a link that looks like it serves a picture but instead downloads a file called image.pif, a Windows program in disguise. The file carries forged details suggesting it belongs to a security product named “Aegis Sentinel”. Double-clicking it quietly pulls down a Windows installer package from a remote server and sets the infection in motion.
Checking for a human at the keyboard
What follows is a multi-stage chain designed to stay out of sight. The malware passes through three heavily obfuscated loaders written in Visual Basic 6, then checks the machine for 329 different applications to confirm it is running on a genuine, in-use computer rather than a researcher’s sandbox. Only then does it inject the final payload into clspack.exe, a legitimate, digitally signed Microsoft program, so that its activity appears to come from a trusted process.
Huntress characterises the result as a shift for DarkMe from an APT-linked tool to a more conventional information stealer.
A broken cipher, previously misread
The researchers also uncovered a flaw in the attackers’ own code. DarkMe’s payload is protected with what was intended to be RC4 encryption, but the implementation skips a key step in setting up the cipher. As a result, the scrambling collapses into a predictable pattern after just a few bytes. Huntress notes that earlier public reporting had described this routine as simple XOR encoding, and its analysis corrects that picture.
The team has also identified a new encryption key and a new command-and-control domain used in the campaign, and has published detection rules, indicators of compromise and remediation guidance alongside the research.
Back to basics
The findings echo a broader trend of well-resourced attackers favouring social engineering over costly vulnerabilities where it delivers the same outcome. For defenders, Huntress’s guidance points to the human side of the attack chain as much as the technical one: treating unusual file types arriving by email with suspicion, and monitoring for legitimate Windows tools being used to fetch and run software from the internet.
