It typically spreads via phishing emails or messaging apps, tricking users into downloading and extracting its contents to compromise their systems.

: Allow attackers to control the infected computer via Hidden VNC (Virtual Network Computing).

: Once extracted, the archive typically contains a VBScript file or an LNK (shortcut) file. Running this file triggers a script that downloads and executes the final payload—such as DarkGate—which can steal credentials, record keystrokes, and grant remote access to the attacker. Associated Malware: DarkGate