DarkGate from Storm-1607 mail

Summary

The earliest use of this technique Microsoft records in email ran from March to June 2024 and is attributed to the group it tracks as Storm-1607. A single run in May 2024 sent tens of thousands of messages to organisations across the United States and Canada, dressed as payments or invoices, with an HTML file attached under names of the shape reports_528647.html. Opening the attachment drew a mock-up of a fresh Word document, overlaid by an error box offering to put the problem right. Pressing that button quietly loaded a command onto the clipboard; the box then changed to explain how to open Windows Terminal and paste it in. The payload was DarkGate, a commodity loader that logs keystrokes, mines coins, talks to a controller and fetches more malware. Microsoft says attaching the lure has since given way to a link pointing at a hosted page.

Cross-vendor timeline

2 published accounts. Proofpoint was first, on 2024-06-17. The most recent is Microsoft Threat Intelligence, 430 days later.

1. 2024-06-17Proofpoint

   From Clipboard to Compromise: A PowerShell Self-Pwn

2. 2025-08-21Microsoft Threat Intelligence+430 days

   Think before you Click(Fix): Analyzing the ClickFix social engineering technique

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

1 of 16

Checks recorded

1

Checks since publication

1

Never checked

15

Observation window 2026-10-11 to 2026-10-11. Checks are sampled, not continuous; the sampling policy is on /methodology. 15 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

16 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.