Researchers reported a real phishing campaign delivering the DarkMe remote-access trojan by emailing victims a link that appears to download a PNG image. Instead, the click downloads a disguised Windows executable (.pif) that runs when double-clicked and then pulls additional stages to install an infostealer/RAT.
This campaign relies on a straightforward phishing email rather than a technical exploit. The message contains a link that supposedly points to a PNG image file. When a recipient clicks it, the link actually triggers the download of a file named image.pif, which is a Windows executable disguised as an image. Researchers noted that attackers are betting on a simple email to convince targets to run it on their machine, showing that sophisticated exploits are not needed when a basic file-naming trick can achieve the same result.
Once downloaded, the file requires a victim to double-click it to run. Victims did exactly that, not realizing what the file actually was. Because modern Windows systems execute .pif files as programs regardless of the extension shown or the icon displayed, the double-click launched a chain of additional downloads and executions that ultimately installed the DarkMe RAT and infostealer. This malware is capable of targeting cryptocurrency wallets and taking screenshots of the victim's system.
The lure works because it exploits a basic assumption: that a file named or labeled as an image is safe to open. Most users do not inspect file extensions closely, especially when an icon or context suggests the file is harmless. The email itself required no urgency, spoofed branding, or executive impersonation to succeed, just a generic request to view an image. This simplicity is part of what makes the technique effective across a broad range of recipients, including everyday corporate staff rather than a narrowly targeted group.
Employees should be trained to verify the sender and purpose of any email pushing them to click a link to view an image or file, especially when unsolicited. Before opening any downloaded file, confirm that its actual file type matches what was promised, for example checking that a supposed image is truly a .png or .jpg rather than an executable format like .pif. Reinforce that double-clicking an unexpected download can execute malware even when the icon looks harmless, since Windows will run certain file types as programs regardless of appearance. Given that this malware specifically targets cryptocurrency wallets and can capture screenshots, finance and trading teams and anyone handling crypto assets should receive additional attention in awareness efforts.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The email includes a link that appears to point to a PNG image file, but clicking it downloads a Windows executable named image.pif instead of an actual image.
Modern Windows systems execute .pif files as programs regardless of the file extension shown or the icon displayed, so double-clicking it runs malware rather than opening a picture.
The chain performs multiple downloads and executions that end with installation of the DarkMe RAT/infostealer, which targets cryptocurrency wallets and can capture screenshots.
The campaign targets all employees and corporate staff broadly, with particular relevance to finance and trading teams and anyone handling cryptocurrency wallets.
You get an email: “Please review the attached image (PNG) at the link below.” Looks harmless, right? But in this DarkMe campaign, that link doesn’t give you a PNG. It silently downloads image.pif, a Windows executable, that runs when you double-click it. Here’s the trap: modern Windows treats .pif as a program, no matter what the icon looks like. Huntress saw people just double-click it, thinking it’s a picture, and end up with DarkMe on their machine. Your move: if a link says it’s an image, check the downloaded file type first. If it’s not .png or .jpg, don’t open it, report it to IT.
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
This weekly threat bulletin includes real-world campaigns where attackers impersonate recruiters and use fake hiring steps to trick people into running malicious files. One campaign uses fake LinkedIn coding tests delivered via cloud links, and another uses fake job interviews with trojanized macOS…
This weekly roundup includes multiple real-world social-engineering and phishing-style operations, including fake recruiter outreach pushing malicious Android apps, phishing emails that trick users into installing remote management tools, and vishing that reportedly led to compromised Okta…
Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government…
