www.forcepoint.com
Open in
urlscan Pro
2a04:4e42::740
Public Scan
URL:
https://www.forcepoint.com/blog/x-labs/phishing-script-inside-darkgate-campaign
Submission: On May 20 via api from US — Scanned from DE
Submission: On May 20 via api from US — Scanned from DE
Form analysis 4 forms found in the DOM
POST /blog/x-labs/phishing-script-inside-darkgate-campaign
<form class="lang_dropdown_form language_content featureWsQuerystringTranslations-processed" id="lang_dropdown_form_language_content" action="/blog/x-labs/phishing-script-inside-darkgate-campaign" method="post" accept-charset="UTF-8">
<div>
<div class="form-item form-type-select form-item-lang-dropdown-select">
<div class="hidden-on-desktop mobile-language has-subnav events-mobile-list-processed"><span class="subnav-header nolink"><span class="link-text-wrapper">EN - English</span></span>
<div class="subnav dropdown menu"><span class="subnav-back">EN - English</span>
<ul class="language-list" id="lang-dropdown-select-language_content" name="lang_dropdown_select">
<li value="en" class="selected">EN - English</li>
<li value="es">ES - Español (América Latina)</li>
<li value="fr">FR - Français</li>
<li value="de">DE - Deutsch</li>
<li value="it">IT - Italiano</li>
<li value="pt-br">PT-BR - Português</li>
<li value="zh-hans">ZH-HANS - 简体中文</li>
<li value="zh-hant">ZH-HANT - 繁體中文</li>
<li value="ja">JA - 日本語</li>
<li value="ko">KO - 한국어</li>
<li value="tr">TR - Türkçe</li>
<li value="ar">AR - العربية</li>
</ul>
</div><span class="subnav-trigger"></span>
</div><select class="lang-dropdown-select-element form-select chosen-processed build-mobile-list-processed" id="lang-dropdown-select-language_content" style="width: 148px; display: none;" name="lang_dropdown_select">
<option value="en" selected="selected">EN - English</option>
<option value="es">ES - Español (América Latina)</option>
<option value="fr">FR - Français</option>
<option value="de">DE - Deutsch</option>
<option value="it">IT - Italiano</option>
<option value="pt-br">PT-BR - Português</option>
<option value="zh-hans">ZH-HANS - 简体中文</option>
<option value="zh-hant">ZH-HANT - 繁體中文</option>
<option value="ja">JA - 日本語</option>
<option value="ko">KO - 한국어</option>
<option value="tr">TR - Türkçe</option>
<option value="ar">AR - العربية</option>
</select>
<div class="chosen-container chosen-container-single lang-dropdown-select-element form-select chosen-processed chosen-container-single-nosearch" style="width: 200px;" title="" id="lang_dropdown_select_language_content_chosen">
<a class="chosen-single" tabindex="-1"><span>EN - English</span><div><b></b></div></a>
<div class="chosen-drop">
<div class="chosen-search"><input type="text" autocomplete="off" readonly=""></div>
<ul class="chosen-results"></ul>
</div>
</div>
</div>
<input type="hidden" name="en" value="/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="es" value="/es/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="fr" value="/fr/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="de" value="/de/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="it" value="/it/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="pt-br" value="/pt-br/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="zh-hans" value="/zh-hans/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="zh-hant" value="/zh-hant/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="ja" value="/ja/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="ko" value="/ko/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="tr" value="/tr/blog/x-labs/phishing-script-inside-darkgate-campaign">
<input type="hidden" name="ar" value="/ar/blog/x-labs/phishing-script-inside-darkgate-campaign">
<noscript>
<div>
<input type="submit" id="edit-submit" name="op" value="Go" class="form-submit">
</div>
</noscript><input type="hidden" name="form_build_id" value="form-uod64h6kUpqYJ3zqBFGIESwNIysYVoo9n3GCMCTHwvY">
<input type="hidden" name="form_id" value="lang_dropdown_form">
</div>
</form>GET /search
<form action="/search" method="get" id="views-exposed-form-site-search-page" accept-charset="UTF-8">
<div>
<div class="views-exposed-form">
<div class="views-exposed-widgets clearfix">
<div id="edit-keys-wrapper" class="views-exposed-widget views-widget-filter-search_api_views_fulltext">
<label for="edit-keys"> Enter your keywords </label>
<div class="views-widget">
<div class="form-item form-type-textfield form-item-keys">
<input placeholder="Search" type="text" id="edit-keys" name="keys" value="" size="30" maxlength="128" class="form-text">
</div>
</div>
</div>
<div id="edit-type-wrapper" class="views-exposed-widget views-widget-filter-type">
<label for="edit-type"> Is Type </label>
<div class="views-widget">
<div class="form-item form-type-hidden form-item-type">
<input type="hidden" name="type" value="All">
</div>
</div>
</div>
<div class="views-exposed-widget views-submit-button">
<input type="submit" id="edit-submit-site-search" value="Search" class="form-submit">
</div>
</div>
</div>
</div>
</form>POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e
<form id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e"
class="hs-form-private hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e_bb800ebd-07ad-401f-9f95-39397efa4cb5 hs-form stacked"
target="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-instance-id="bb800ebd-07ad-401f-9f95-39397efa4cb5" data-form-id="16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-portal-id="20987017"
data-test-id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e">
<div class="hs_conversion_prod_interest___most_recent hs-conversion_prod_interest___most_recent hs-fieldtype-text field hs-form-field" style="display: none;"><label
id="label-conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Prod Interest - Most Recent"
for="conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Prod Interest - Most Recent</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_prod_interest___most_recent" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_sfcmpid hs-sfcmpid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your sfcmpid"
for="sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>sfcmpid</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sfcmpid" class="hs-input" type="hidden" value="7016T000002HlhQQAS"></div>
</div>
<div class="hs_sf_source_campaign_id hs-sf_source_campaign_id hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your SF Source Campaign ID" for="sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>SF Source Campaign ID</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sf_source_campaign_id" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_salesforce_campaign_name hs-salesforce_campaign_name hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your Salesforce Campaign Name" for="salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Salesforce Campaign Name</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="salesforce_campaign_name" class="hs-input" type="hidden" value="WW.BRN.WEBS.X-Labs_Newsletter_Sign_Up.Ever"></div>
</div>
<div class="hs_core_non_core hs-core_non_core hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Core/Non-core"
for="core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Core/Non-core</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="core_non_core" class="hs-input" type="hidden" value="Non-core"></div>
</div>
<div class="hs_gclid hs-gclid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your GCLID - DO NOT USE"
for="gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>GCLID - DO NOT USE</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="gclid" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_email_opt_in_security_research__c hs-email_opt_in_security_research__c hs-fieldtype-booleancheckbox field hs-form-field" style="display: none;">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="email_opt_in_security_research__c" class="hs-input" type="hidden" value="true"></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Work Email" for="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Work
Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" name="email" required="" placeholder="Email Address" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs-dependent-field">
<div class="hs_country__c hs-country__c hs-fieldtype-select field hs-form-field smart-field"><label id="label-country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Country Picklist"
for="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Country Picklist</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" required="" class="hs-input" name="country__c">
<option disabled="" value="">Select Country</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Aland Islands">Aland Islands</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antarctica">Antarctica</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermuda">Bermuda</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia, Plurinational State of">Bolivia, Plurinational State of</option>
<option value="Bonaire, Sint Eustatius and Saba">Bonaire, Sint Eustatius and Saba</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Indian Ocean Territory">British Indian Ocean Territory</option>
<option value="Brunei Darussalam">Brunei Darussalam</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Chinese Taipei">Chinese Taipei</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo">Congo</option>
<option value="Congo, the Democratic Republic of the">Congo, the Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire">Cote d'Ivoire</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curaçao">Curaçao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Falkland Islands (Malvinas)">Falkland Islands (Malvinas)</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="French Southern Territories">French Southern Territories</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey">Guernsey</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Heard Island and McDonald Islands">Heard Island and McDonald Islands</option>
<option value="Holy See (Vatican City State)">Holy See (Vatican City State)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran, Islamic Republic of">Iran, Islamic Republic of</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Isle of Man">Isle of Man</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Ivory Coast">Ivory Coast</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Korea, Democratic People's Republic of">Korea, Democratic People's Republic of</option>
<option value="Korea, Republic of">Korea, Republic of</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Lao People's Democratic Republic">Lao People's Democratic Republic</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macao">Macao</option>
<option value="Macedonia, the former Yugoslav Republic of">Macedonia, the former Yugoslav Republic of</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mexico">Mexico</option>
<option value="Micronesia, Federated States of">Micronesia, Federated States of</option>
<option value="Moldova, Republic of">Moldova, Republic of</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palestinian Territory, occupied">Palestinian Territory, Occupied</option>
<option value="Panama">Panama</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn">Pitcairn</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saint Barthélemy">Saint Barthélemy</option>
<option value="Saint Helena, Ascension and Tristan da Cunha">Saint Helena, Ascension and Tristan da Cunha</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Martin (French part)">Saint Martin (French part)</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Maarten (Dutch part)">Sint Maarten (Dutch part)</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Georgia and the South Sandwich Islands">South Georgia and the South Sandwich Islands</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard and Jan Mayen">Svalbard and Jan Mayen</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syrian Arab Republic">Syrian Arab Republic</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Timor-Leste">Timor-Leste</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad and Tobago">Trinidad and Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks and Caicos Islands">Turks and Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States">United States</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Viet Nam">Viet Nam</option>
<option value="Virgin Islands, British">Virgin Islands, British</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
<option value="Slovakia">Slovakia</option>
<option value="Venezuela, Bolivarian Republic of">Venezuela, Bolivarian Republic of</option>
</select></div>
</div>
</div>
<div>
<div class="hs-richtext hs-main-font-element">
<p style="font-size: 12px;">By submitting this form, you agree to our <a href="https://www.forcepoint.com/legal/website-terms-and-conditions">terms</a> and to receiving communications from Forcepoint, you acknowledge our
<a href="https://www.forcepoint.com/company/privacy-policy">privacy policy</a> and you consent to the processing of your data. You can <a href="https://www.forcepoint.com/email-communication-preference-center">unsubscribe</a> at any time.</p>
</div>
</div>
<div class="hs_conversion_type hs-conversion_type hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Type"
for="conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Type</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_type" class="hs-input" type="hidden" value="Newsletter Sign-Up"></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Sign Up"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1716220409947","formDefinitionUpdatedAt":"1713365382354","lang":"en","embedType":"REGULAR","clonedFromForm":"c5d286e0-e74d-4914-95cd-1df5fc073545","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","pageTitle":"From Document to Script: Insides of Darkgate's Campaign","pageUrl":"https://www.forcepoint.com/blog/x-labs/phishing-script-inside-darkgate-campaign","isHubSpotCmsGeneratedPage":false,"formTarget":"#form-nid-38032-664b71f80c753","boolCheckBoxFields":"email_opt_in_security_research__c","rumScriptExecuteTime":2128.5999994277954,"rumTotalRequestTime":2407.5,"rumTotalRenderTime":2451.5,"rumServiceResponseTime":278.9000005722046,"rumFormRenderTime":44,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1716220411119,"originalEmbedContext":{"portalId":"20987017","formId":"16d5bf15-75bb-43be-a7ff-4e4e9779520e","region":"na1","target":"#form-nid-38032-664b71f80c753","isBuilder":false,"isTestPage":false,"isPreview":false,"redirectUrl":"https://www.forcepoint.com/thank-you-signing-our-newsletter","locale":"en","isMobileResponsive":true},"correlationId":"bb800ebd-07ad-401f-9f95-39397efa4cb5","renderedFieldsIds":["conversion_prod_interest___most_recent","sfcmpid","sf_source_campaign_id","salesforce_campaign_name","core_non_core","gclid","email_opt_in_security_research__c","email","country__c","conversion_type"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.5064","sourceName":"forms-embed","sourceVersion":"1.5064","sourceVersionMajor":"1","sourceVersionMinor":"5064","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1716220410015,"level":"INFO","message":"Retrieved customer callbacks used on embed context: [\"onFormReady\",\"onFormSubmit\"]"},{"clientTimestamp":1716220410015,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"From Document to Script: Insides of Darkgate's Campaign\",\"pageUrl\":\"https://www.forcepoint.com/blog/x-labs/phishing-script-inside-darkgate-campaign\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1716220410018,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""}]}"><iframe
name="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" style="display: none;"></iframe>
</form>POST https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e
<form id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e" method="POST" accept-charset="UTF-8" enctype="multipart/form-data" novalidate=""
action="https://forms.hsforms.com/submissions/v3/public/submit/formsnext/multipart/20987017/16d5bf15-75bb-43be-a7ff-4e4e9779520e"
class="hs-form-private hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e hs-form-16d5bf15-75bb-43be-a7ff-4e4e9779520e_f4e757ee-a9d3-4185-b303-6066850784f1 hs-form stacked"
target="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-instance-id="f4e757ee-a9d3-4185-b303-6066850784f1" data-form-id="16d5bf15-75bb-43be-a7ff-4e4e9779520e" data-portal-id="20987017"
data-test-id="hsForm_16d5bf15-75bb-43be-a7ff-4e4e9779520e">
<div class="hs_conversion_prod_interest___most_recent hs-conversion_prod_interest___most_recent hs-fieldtype-text field hs-form-field" style="display: none;"><label
id="label-conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Prod Interest - Most Recent"
for="conversion_prod_interest___most_recent-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Prod Interest - Most Recent</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_prod_interest___most_recent" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_sfcmpid hs-sfcmpid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your sfcmpid"
for="sfcmpid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>sfcmpid</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sfcmpid" class="hs-input" type="hidden" value="7016T000002HlhQQAS"></div>
</div>
<div class="hs_sf_source_campaign_id hs-sf_source_campaign_id hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your SF Source Campaign ID" for="sf_source_campaign_id-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>SF Source Campaign ID</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="sf_source_campaign_id" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_salesforce_campaign_name hs-salesforce_campaign_name hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class=""
placeholder="Enter your Salesforce Campaign Name" for="salesforce_campaign_name-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Salesforce Campaign Name</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="salesforce_campaign_name" class="hs-input" type="hidden" value="WW.BRN.WEBS.X-Labs_Newsletter_Sign_Up.Ever"></div>
</div>
<div class="hs_core_non_core hs-core_non_core hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Core/Non-core"
for="core_non_core-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Core/Non-core</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="core_non_core" class="hs-input" type="hidden" value="Non-core"></div>
</div>
<div class="hs_gclid hs-gclid hs-fieldtype-text field hs-form-field" style="display: none;"><label id="label-gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your GCLID - DO NOT USE"
for="gclid-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>GCLID - DO NOT USE</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="gclid" class="hs-input" type="hidden" value=""></div>
</div>
<div class="hs_email_opt_in_security_research__c hs-email_opt_in_security_research__c hs-fieldtype-booleancheckbox field hs-form-field" style="display: none;">
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="email_opt_in_security_research__c" class="hs-input" type="hidden" value="true"></div>
</div>
<div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Work Email" for="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Work
Email</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input id="email-16d5bf15-75bb-43be-a7ff-4e4e9779520e" name="email" required="" placeholder="Email Address" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
</div>
<div class="hs-dependent-field">
<div class="hs_country__c hs-country__c hs-fieldtype-select field hs-form-field smart-field" style="display: none;"><label id="label-country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Country Picklist"
for="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Country Picklist</span><span class="hs-form-required">*</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><select id="country__c-16d5bf15-75bb-43be-a7ff-4e4e9779520e" required="" class="hs-input" name="country__c">
<option disabled="" value="">Select Country</option>
<option value="Afghanistan">Afghanistan</option>
<option value="Aland Islands">Aland Islands</option>
<option value="Albania">Albania</option>
<option value="Algeria">Algeria</option>
<option value="Andorra">Andorra</option>
<option value="Angola">Angola</option>
<option value="Anguilla">Anguilla</option>
<option value="Antarctica">Antarctica</option>
<option value="Antigua and Barbuda">Antigua and Barbuda</option>
<option value="Argentina">Argentina</option>
<option value="Armenia">Armenia</option>
<option value="Aruba">Aruba</option>
<option value="Australia">Australia</option>
<option value="Austria">Austria</option>
<option value="Azerbaijan">Azerbaijan</option>
<option value="Bahamas">Bahamas</option>
<option value="Bahrain">Bahrain</option>
<option value="Bangladesh">Bangladesh</option>
<option value="Barbados">Barbados</option>
<option value="Belarus">Belarus</option>
<option value="Belgium">Belgium</option>
<option value="Belize">Belize</option>
<option value="Benin">Benin</option>
<option value="Bermuda">Bermuda</option>
<option value="Bhutan">Bhutan</option>
<option value="Bolivia, Plurinational State of">Bolivia, Plurinational State of</option>
<option value="Bonaire, Sint Eustatius and Saba">Bonaire, Sint Eustatius and Saba</option>
<option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
<option value="Botswana">Botswana</option>
<option value="Bouvet Island">Bouvet Island</option>
<option value="Brazil">Brazil</option>
<option value="British Indian Ocean Territory">British Indian Ocean Territory</option>
<option value="Brunei Darussalam">Brunei Darussalam</option>
<option value="Bulgaria">Bulgaria</option>
<option value="Burkina Faso">Burkina Faso</option>
<option value="Burundi">Burundi</option>
<option value="Cambodia">Cambodia</option>
<option value="Cameroon">Cameroon</option>
<option value="Canada">Canada</option>
<option value="Cape Verde">Cape Verde</option>
<option value="Cayman Islands">Cayman Islands</option>
<option value="Central African Republic">Central African Republic</option>
<option value="Chad">Chad</option>
<option value="Chile">Chile</option>
<option value="China">China</option>
<option value="Chinese Taipei">Chinese Taipei</option>
<option value="Christmas Island">Christmas Island</option>
<option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
<option value="Colombia">Colombia</option>
<option value="Comoros">Comoros</option>
<option value="Congo">Congo</option>
<option value="Congo, the Democratic Republic of the">Congo, the Democratic Republic of the</option>
<option value="Cook Islands">Cook Islands</option>
<option value="Costa Rica">Costa Rica</option>
<option value="Cote d'Ivoire">Cote d'Ivoire</option>
<option value="Croatia">Croatia</option>
<option value="Cuba">Cuba</option>
<option value="Curaçao">Curaçao</option>
<option value="Cyprus">Cyprus</option>
<option value="Czech Republic">Czech Republic</option>
<option value="Denmark">Denmark</option>
<option value="Djibouti">Djibouti</option>
<option value="Dominica">Dominica</option>
<option value="Dominican Republic">Dominican Republic</option>
<option value="Ecuador">Ecuador</option>
<option value="Egypt">Egypt</option>
<option value="El Salvador">El Salvador</option>
<option value="Equatorial Guinea">Equatorial Guinea</option>
<option value="Eritrea">Eritrea</option>
<option value="Estonia">Estonia</option>
<option value="Ethiopia">Ethiopia</option>
<option value="Falkland Islands (Malvinas)">Falkland Islands (Malvinas)</option>
<option value="Faroe Islands">Faroe Islands</option>
<option value="Fiji">Fiji</option>
<option value="Finland">Finland</option>
<option value="France">France</option>
<option value="French Guiana">French Guiana</option>
<option value="French Polynesia">French Polynesia</option>
<option value="French Southern Territories">French Southern Territories</option>
<option value="Gabon">Gabon</option>
<option value="Gambia">Gambia</option>
<option value="Georgia">Georgia</option>
<option value="Germany">Germany</option>
<option value="Ghana">Ghana</option>
<option value="Gibraltar">Gibraltar</option>
<option value="Greece">Greece</option>
<option value="Greenland">Greenland</option>
<option value="Grenada">Grenada</option>
<option value="Guadeloupe">Guadeloupe</option>
<option value="Guam">Guam</option>
<option value="Guatemala">Guatemala</option>
<option value="Guernsey">Guernsey</option>
<option value="Guinea">Guinea</option>
<option value="Guinea-Bissau">Guinea-Bissau</option>
<option value="Guyana">Guyana</option>
<option value="Haiti">Haiti</option>
<option value="Heard Island and McDonald Islands">Heard Island and McDonald Islands</option>
<option value="Holy See (Vatican City State)">Holy See (Vatican City State)</option>
<option value="Honduras">Honduras</option>
<option value="Hong Kong">Hong Kong</option>
<option value="Hungary">Hungary</option>
<option value="Iceland">Iceland</option>
<option value="India">India</option>
<option value="Indonesia">Indonesia</option>
<option value="Iran, Islamic Republic of">Iran, Islamic Republic of</option>
<option value="Iraq">Iraq</option>
<option value="Ireland">Ireland</option>
<option value="Isle of Man">Isle of Man</option>
<option value="Israel">Israel</option>
<option value="Italy">Italy</option>
<option value="Ivory Coast">Ivory Coast</option>
<option value="Jamaica">Jamaica</option>
<option value="Japan">Japan</option>
<option value="Jersey">Jersey</option>
<option value="Jordan">Jordan</option>
<option value="Kazakhstan">Kazakhstan</option>
<option value="Kenya">Kenya</option>
<option value="Kiribati">Kiribati</option>
<option value="Korea, Democratic People's Republic of">Korea, Democratic People's Republic of</option>
<option value="Korea, Republic of">Korea, Republic of</option>
<option value="Kosovo">Kosovo</option>
<option value="Kuwait">Kuwait</option>
<option value="Kyrgyzstan">Kyrgyzstan</option>
<option value="Lao People's Democratic Republic">Lao People's Democratic Republic</option>
<option value="Latvia">Latvia</option>
<option value="Lebanon">Lebanon</option>
<option value="Lesotho">Lesotho</option>
<option value="Liberia">Liberia</option>
<option value="Libyan Arab Jamahiriya">Libyan Arab Jamahiriya</option>
<option value="Liechtenstein">Liechtenstein</option>
<option value="Lithuania">Lithuania</option>
<option value="Luxembourg">Luxembourg</option>
<option value="Macao">Macao</option>
<option value="Macedonia, the former Yugoslav Republic of">Macedonia, the former Yugoslav Republic of</option>
<option value="Madagascar">Madagascar</option>
<option value="Malawi">Malawi</option>
<option value="Malaysia">Malaysia</option>
<option value="Maldives">Maldives</option>
<option value="Mali">Mali</option>
<option value="Malta">Malta</option>
<option value="Martinique">Martinique</option>
<option value="Mauritania">Mauritania</option>
<option value="Mauritius">Mauritius</option>
<option value="Mexico">Mexico</option>
<option value="Micronesia, Federated States of">Micronesia, Federated States of</option>
<option value="Moldova, Republic of">Moldova, Republic of</option>
<option value="Monaco">Monaco</option>
<option value="Mongolia">Mongolia</option>
<option value="Montenegro">Montenegro</option>
<option value="Montserrat">Montserrat</option>
<option value="Morocco">Morocco</option>
<option value="Mozambique">Mozambique</option>
<option value="Myanmar">Myanmar</option>
<option value="Namibia">Namibia</option>
<option value="Nauru">Nauru</option>
<option value="Nepal">Nepal</option>
<option value="Netherlands">Netherlands</option>
<option value="New Caledonia">New Caledonia</option>
<option value="New Zealand">New Zealand</option>
<option value="Nicaragua">Nicaragua</option>
<option value="Niger">Niger</option>
<option value="Nigeria">Nigeria</option>
<option value="Niue">Niue</option>
<option value="Norfolk Island">Norfolk Island</option>
<option value="Norway">Norway</option>
<option value="Oman">Oman</option>
<option value="Pakistan">Pakistan</option>
<option value="Palestinian Territory, occupied">Palestinian Territory, Occupied</option>
<option value="Panama">Panama</option>
<option value="Papua New Guinea">Papua New Guinea</option>
<option value="Paraguay">Paraguay</option>
<option value="Peru">Peru</option>
<option value="Philippines">Philippines</option>
<option value="Pitcairn">Pitcairn</option>
<option value="Poland">Poland</option>
<option value="Portugal">Portugal</option>
<option value="Puerto Rico">Puerto Rico</option>
<option value="Qatar">Qatar</option>
<option value="Reunion">Reunion</option>
<option value="Romania">Romania</option>
<option value="Russian Federation">Russian Federation</option>
<option value="Rwanda">Rwanda</option>
<option value="Saint Barthélemy">Saint Barthélemy</option>
<option value="Saint Helena, Ascension and Tristan da Cunha">Saint Helena, Ascension and Tristan da Cunha</option>
<option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
<option value="Saint Lucia">Saint Lucia</option>
<option value="Saint Martin (French part)">Saint Martin (French part)</option>
<option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
<option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
<option value="Samoa">Samoa</option>
<option value="San Marino">San Marino</option>
<option value="Sao Tome and Principe">Sao Tome and Principe</option>
<option value="Saudi Arabia">Saudi Arabia</option>
<option value="Senegal">Senegal</option>
<option value="Serbia">Serbia</option>
<option value="Seychelles">Seychelles</option>
<option value="Sierra Leone">Sierra Leone</option>
<option value="Singapore">Singapore</option>
<option value="Sint Maarten (Dutch part)">Sint Maarten (Dutch part)</option>
<option value="Slovenia">Slovenia</option>
<option value="Solomon Islands">Solomon Islands</option>
<option value="Somalia">Somalia</option>
<option value="South Africa">South Africa</option>
<option value="South Georgia and the South Sandwich Islands">South Georgia and the South Sandwich Islands</option>
<option value="South Sudan">South Sudan</option>
<option value="Spain">Spain</option>
<option value="Sri Lanka">Sri Lanka</option>
<option value="Sudan">Sudan</option>
<option value="Suriname">Suriname</option>
<option value="Svalbard and Jan Mayen">Svalbard and Jan Mayen</option>
<option value="Swaziland">Swaziland</option>
<option value="Sweden">Sweden</option>
<option value="Switzerland">Switzerland</option>
<option value="Syrian Arab Republic">Syrian Arab Republic</option>
<option value="Taiwan">Taiwan</option>
<option value="Tajikistan">Tajikistan</option>
<option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
<option value="Thailand">Thailand</option>
<option value="Timor-Leste">Timor-Leste</option>
<option value="Togo">Togo</option>
<option value="Tokelau">Tokelau</option>
<option value="Tonga">Tonga</option>
<option value="Trinidad and Tobago">Trinidad and Tobago</option>
<option value="Tunisia">Tunisia</option>
<option value="Turkey">Turkey</option>
<option value="Turkmenistan">Turkmenistan</option>
<option value="Turks and Caicos Islands">Turks and Caicos Islands</option>
<option value="Tuvalu">Tuvalu</option>
<option value="Uganda">Uganda</option>
<option value="Ukraine">Ukraine</option>
<option value="United Arab Emirates">United Arab Emirates</option>
<option value="United Kingdom">United Kingdom</option>
<option value="United States">United States</option>
<option value="Uruguay">Uruguay</option>
<option value="Uzbekistan">Uzbekistan</option>
<option value="Vanuatu">Vanuatu</option>
<option value="Viet Nam">Viet Nam</option>
<option value="Virgin Islands, British">Virgin Islands, British</option>
<option value="Virgin Islands, U.S.">Virgin Islands, U.S.</option>
<option value="Wallis and Futuna">Wallis and Futuna</option>
<option value="Western Sahara">Western Sahara</option>
<option value="Yemen">Yemen</option>
<option value="Zambia">Zambia</option>
<option value="Zimbabwe">Zimbabwe</option>
<option value="Slovakia">Slovakia</option>
<option value="Venezuela, Bolivarian Republic of">Venezuela, Bolivarian Republic of</option>
</select></div>
</div>
</div>
<div>
<div class="hs-richtext hs-main-font-element">
<p style="font-size: 12px;">By submitting this form, you agree to our <a href="https://www.forcepoint.com/legal/website-terms-and-conditions">terms</a> and to receiving communications from Forcepoint, you acknowledge our
<a href="https://www.forcepoint.com/company/privacy-policy">privacy policy</a> and you consent to the processing of your data. You can <a href="https://www.forcepoint.com/email-communication-preference-center">unsubscribe</a> at any time.</p>
</div>
</div>
<div class="hs_conversion_type hs-conversion_type hs-fieldtype-select field hs-form-field" style="display: none;"><label id="label-conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e" class="" placeholder="Enter your Conversion Type"
for="conversion_type-16d5bf15-75bb-43be-a7ff-4e4e9779520e"><span>Conversion Type</span></label>
<legend class="hs-field-desc" style="display: none;"></legend>
<div class="input"><input name="conversion_type" class="hs-input" type="hidden" value="Newsletter Sign-Up"></div>
</div>
<div class="hs_submit hs-submit">
<div class="hs-field-desc" style="display: none;"></div>
<div class="actions"><input type="submit" class="hs-button primary large" value="Sign Up"></div>
</div><input name="hs_context" type="hidden"
value="{"embedAtTimestamp":"1716220410089","formDefinitionUpdatedAt":"1713365382354","lang":"en","embedType":"REGULAR","clonedFromForm":"c5d286e0-e74d-4914-95cd-1df5fc073545","renderRawHtml":"true","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","pageTitle":"From Document to Script: Insides of Darkgate's Campaign","pageUrl":"https://www.forcepoint.com/blog/x-labs/phishing-script-inside-darkgate-campaign","isHubSpotCmsGeneratedPage":false,"formTarget":"#form-nid-27476-664b71f939bea","boolCheckBoxFields":"email_opt_in_security_research__c","rumScriptExecuteTime":2128.5999994277954,"rumTotalRequestTime":2539.5999994277954,"rumTotalRenderTime":2560.699999809265,"rumServiceResponseTime":411,"rumFormRenderTime":21.100000381469727,"connectionType":"4g","firstContentfulPaint":0,"largestContentfulPaint":0,"locale":"en","timestamp":1716220411174,"originalEmbedContext":{"portalId":"20987017","formId":"16d5bf15-75bb-43be-a7ff-4e4e9779520e","region":"na1","target":"#form-nid-27476-664b71f939bea","isBuilder":false,"isTestPage":false,"isPreview":false,"redirectUrl":"https://www.forcepoint.com/thank-you-signing-our-newsletter","locale":"en","isMobileResponsive":true},"correlationId":"f4e757ee-a9d3-4185-b303-6066850784f1","renderedFieldsIds":["conversion_prod_interest___most_recent","sfcmpid","sf_source_campaign_id","salesforce_campaign_name","core_non_core","gclid","email_opt_in_security_research__c","email","country__c","conversion_type"],"captchaStatus":"NOT_APPLICABLE","emailResubscribeStatus":"NOT_APPLICABLE","isInsideCrossOriginFrame":false,"source":"forms-embed-1.5064","sourceName":"forms-embed","sourceVersion":"1.5064","sourceVersionMajor":"1","sourceVersionMinor":"5064","allPageIds":{},"_debug_embedLogLines":[{"clientTimestamp":1716220410149,"level":"INFO","message":"Retrieved customer callbacks used on embed context: [\"onFormReady\",\"onFormSubmit\"]"},{"clientTimestamp":1716220410149,"level":"INFO","message":"Retrieved pageContext values which may be overriden by the embed context: {\"pageTitle\":\"From Document to Script: Insides of Darkgate's Campaign\",\"pageUrl\":\"https://www.forcepoint.com/blog/x-labs/phishing-script-inside-darkgate-campaign\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\",\"isHubSpotCmsGeneratedPage\":false}"},{"clientTimestamp":1716220410150,"level":"INFO","message":"Retrieved countryCode property from normalized embed definition response: \"DE\""}]}"><iframe
name="target_iframe_16d5bf15-75bb-43be-a7ff-4e4e9779520e" style="display: none;"></iframe>
</form>Text Content
Skip to main content
Forcepoint
* Partners
Partners
* Partner Login
* Find a Partner
* Become a Partner
* Global Partner Program
* Technology Partners
* Find a Distributor
* Services & Support
Services & Support
* Support Login
* Professional Services
* Training
* Company
Company
* Customers
* Newsroom
* Work With Us
* Contact Us
* Forcepoint Trust Hub
EN - English
EN - English
* EN - English
* ES - Español (América Latina)
* FR - Français
* DE - Deutsch
* IT - Italiano
* PT-BR - Português
* ZH-HANS - 简体中文
* ZH-HANT - 繁體中文
* JA - 日本語
* KO - 한국어
* TR - Türkçe
* AR - العربية
EN - EnglishES - Español (América Latina)FR - FrançaisDE - DeutschIT -
ItalianoPT-BR - PortuguêsZH-HANS - 简体中文ZH-HANT - 繁體中文JA - 日本語KO - 한국어TR -
TürkçeAR - العربية
EN - English
Enter your keywords
Is Type
Jump to
* Why Forcepoint
Why Forcepoint
* group
* About Us Our vision and mission
* Our Approach Our data-first approach to cybersecurity
* Our Customers We help people work freely, securely and with confidence
* Data Security Everywhere
Data Security Everywhere
* group (1st row)
* group (Data Security Everywhere)
* Data Security Everywhere Work Anywhere with Data Everywhere. Safely.
Discover How
* group (Products)
* group (Products 1st Row)
* Featured Products
* Forcepoint ONE Data Security (Cloud DLP) Prevent breaches and
streamline compliance from the cloud.
* Enterprise DLP Industry-leading DLP with enterprise-class
accuracy and automation.
* DSPM (Data Security Posture Management) Discover, classify and
orchestrate with AI-powered automation.
* Data Classification Increase the accuracy and efficiency of
classification.
* Risk Adaptive Protection Respond to risk in real-time with policy
automation.
* DLP for Email Prevent data exfiltration within outbound emails.
* group (Products 2nd row)
* Top-Rated Solutions
* Unify Cloud, Endpoint and BYOD Data Protection
* Automate Data Security Based on Risky Behavior
* Discover and Secure Unstructured Data with AI
* Classify and Protect Sensitive Data with AI
* Prevent Data Theft in Outbound Emails
* Protect Users and Data on the Web
* group (2nd row)
* Schedule a Live Demo
* On-Demand Demo
* Data-first SASE
Data-first SASE
* group (row1)
* group (FP ONE)
* Forcepoint ONE Simplify and Secure Access to Data Everywhere
Discover How
* group (products)
* group (products 1st row)
* Featured Products
* Cloud Access Security Broker Secure data on any public cloud
application.
* Zero Trust Network Access Remotely access every private web app
on any device.
* Secure Web Gateway Safely browse the web and download files.
* Remote Browser Isolation Render risky websites in a container to
browse safely.
* Cloud Firewall Inspect traffic and protect against threats.
* Secure SD-WAN Connect and protect branches, offices and more.
* group (products 2nd row)
* Top-Rated Solutions
* Simplify Security at the Edge
* Work Safely from Anywhere
* Connect and Protect Remote Offices
* Enable Remote Workers
* Safely Use ChatGPT and Generative AI
* Secure Data in Microsoft 365
* group (row2)
* Schedule a Live Demo
* On-Demand Demo
* Resources
Resources
* group (links column)
* group (resource links)
* Blog
* Webcasts
* Podcasts
* Analyst Reports
* Customer Stories
* Resource Library
* Training
* --------------------------------------------------------------------------------
* group (cyber edut)
* Cyber Edu Learn More
* group (cta column)
* group (cards)
* Guide Ultimate Guide to Data Security Dive into the Guide
* Video Forcepoint Data Security Posture Management Demo Watch the
Video
* Analyst Report Forcepoint has been named a leader in The Forrester
Wave: Security Service Edge Solutions, Q1 2024 Read the Report
* Podcast The Radical Transparency Opportunity in Cybersecurity Listen
to the Podcast
* View All Resources
* Talk to an Expert
Main Menu
YOU ARE HERE
Home:Blogs:From Document to Script: Insides of Darkgate's Campaign
X-Labs
May 14, 2024 | 6 min read
FROM DOCUMENT TO SCRIPT: INSIDES OF DARKGATE'S CAMPAIGN
Mayur Sewani
Email Security Phishing Research
One of the primary propagation methods for Darkgate is phishing emails. By
hijacking email accounts, distributing malicious attachment and it propagate
itself to a wider network of potential victims. Darkgate uses some of the most
common attachment filetypes such as XLSX, HTML and PDF. It is often designed to
be stealthy and persistent, making it challenging to detect and remove. It may
result in the loss of personal data, financial loss through fraud or extortion,
and compromise of sensitive information.
This post provides a detailed examination of a recent Darkgate campaign
identified by Forcepoint's X-Labs research team. The campaign commences with the
initiation of attacks via a compromised email, featuring an invoice purportedly
from 'Intuit Quickbooks' in PDF format. It prompts users to install Java to view
the invoice, providing a link. Upon clicking the link, users are redirected to a
geofenced URL where they inadvertently download the subsequent stage payload.
Image 1 - Attack Chain
Through a comprehensive analysis of a suspicious PDF file named
"may-document_[number].pdf", it reveals an invoice document containing an
XObject large image with an embedded hyperlink. Upon user interaction with the
hyperlink, it triggers the download of a malicious .jar (Java Archive) file.
The URLs associated with this malicious activity follow a historical pattern,
featuring domains and single paths reminiscent of those previously utilized by
QakBot threat actors.
Image 2 - PDF attachment
Image 3 - Static view of URL inside PDF
When inspecting the subsequently downloaded JAR file using JD-GUI, it revealed a
.PNG file and a
<random-name>.class file. Within this class file, there exists a Java function
aiming to download a .ZIP file to the directory 'C:\Downloads\' through an
obfuscated 'curl.exe' command. Upon successful download of the ZIP file, it
triggers PowerShell to extract its contents using the 'expand-archive' command.
Image 4 - JAR Class file
The JAR's class file additionally features another function designed to download
and store files with the
.MSI extension. Upon extraction of the downloaded ZIP file, it reveals
'autoit3.exe' and a compiled AutoIt script with the '.a3x' extension.
Subsequently, the JAR file executes an obfuscated 'cmd /c' command to run this
compiled AutoIt script. It's noteworthy that DarkGate has a history of
leveraging AutoIt in its previous campaigns. The script appears to have been
compiled with AutoIt version 3.26 or later, as indicated by the header
'AU3!EA06'.
Image 5 - Autoit compiled script
The decompiled script reveals obfuscated AutoIt functions such as BITXOR and
BinaryToString(), which are employed to obscure the script's functionality. It
attempts to store a large stream of data in a local variable through
concatenation operations. Additionally, DLLSTRUCTCREATE() and DLLSTRUCTSETDATA()
functions are utilized to create a structure and load bytes into memory, likely
for manipulation or interaction with system resources.
Image 6.1 - Decompiled autoit
Image 6.2 - Decompiled autoit
This malicious autoit script further executes actual shell code in memory and
perform connection with remote C&C botnet server.
CONCLUSION:
The Darkgate campaign, dissected by the Forcepoint research team, begins with
phishing emails posing as QuickBooks invoices, urging users to install Java.
Clicking the embedded link leads to a geofenced URL, unwittingly downloading a
malicious JAR file. Further analysis uncovers a complex structure within the JAR
file, including commands to download additional payloads, such as an AutoIt
script. This script compiled with AutoIt, employs obfuscation techniques to
conceal its functionality, executing shell code and establishing connections
with remote Command and Control servers. The campaign's use of historical URL
patterns and sophisticated malware techniques underscores its advanced nature
and highlights the ongoing threat posed by Darkgate.
PROTECTION STATEMENT
Forcepoint customers are protected against this threat at the following stages
of attack:
* Stage 2 (Lure) – Malicious attachments associated with these attacks are
identified and blocked.
* Stage 5 (Dropper File) - The dropper files are added to Forcepoint malicious
database and are blocked.
* Stage 6 (Call Home) - Blocked C&C domain
IOCS
Initial Stage URLs:
* afarm[.]net/uvz2q
* affixio[.]com/emh0c
* affiliatebash[.]com/myu0f
* afcmanager[.]net/jxk6m
* adventsales[.]co[.]uk/iuw8a
* amikamobile[.]com/ayu4d
* adztrk[.]com/ixi7r
* aerospaceavenue[.]com/cnz8g
* amishwoods[.]com/jwa4v
Second stage URL:
* smbeckwithlaw[.]com/1[.]zip
C2:
* kindupdates[.]com
MAYUR SEWANI
Mayur serves as a Senior Security Researcher as part of the Forcepoint X-Labs
Research Team. He focuses on APT malwares, information stealers, phishing
attacks, and also works to stay on top of the latest threats. He is passionate
about advancing the field of defensive adversary...
Read more articles by Mayur Sewani
ABOUT FORCEPOINT
Forcepoint is the leading user and data protection cybersecurity company,
entrusted to safeguard organizations while driving digital transformation and
growth. Our solutions adapt in real-time to how people interact with data,
providing secure access while enabling employees to create value.
Learn more about Forcepoint
Email Security
IN THE ARTICLE
SHARE
LinkedIn
Twitter
Facebook
FORCEPOINT | X-LABS
SIGN UP FOR THE LATEST FROM OUR RESEARCH AND DEVELOPMENT TEAM
Conversion Prod Interest - Most Recent
sfcmpid
SF Source Campaign ID
Salesforce Campaign Name
Core/Non-core
GCLID - DO NOT USE
Work Email*
Country Picklist*
Select CountryAfghanistanAland
IslandsAlbaniaAlgeriaAndorraAngolaAnguillaAntarcticaAntigua and
BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBolivia,
Plurinational State ofBonaire, Sint Eustatius and SabaBosnia and
HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei
DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman
IslandsCentral African RepublicChadChileChinaChinese TaipeiChristmas IslandCocos
(Keeling) IslandsColombiaComorosCongoCongo, the Democratic Republic of theCook
IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe
IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern
TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard
Island and McDonald IslandsHoly See (Vatican City State)HondurasHong
KongHungaryIcelandIndiaIndonesiaIran, Islamic Republic ofIraqIrelandIsle of
ManIsraelItalyIvory CoastJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea,
Democratic People's Republic ofKorea, Republic ofKosovoKuwaitKyrgyzstanLao
People's Democratic RepublicLatviaLebanonLesothoLiberiaLibyan Arab
JamahiriyaLiechtensteinLithuaniaLuxembourgMacaoMacedonia, the former Yugoslav
Republic
ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMartiniqueMauritaniaMauritiusMexicoMicronesia,
Federated States ofMoldova, Republic
ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk
IslandNorwayOmanPakistanPalestinian Territory, OccupiedPanamaPapua New
GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto
RicoQatarReunionRomaniaRussian FederationRwandaSaint BarthélemySaint Helena,
Ascension and Tristan da CunhaSaint Kitts and NevisSaint LuciaSaint Martin
(French part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan
MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra
LeoneSingaporeSint Maarten (Dutch part)SloveniaSolomon IslandsSomaliaSouth
AfricaSouth Georgia and the South Sandwich IslandsSouth SudanSpainSri
LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab
RepublicTaiwanTajikistanTanzania, United Republic
ofThailandTimor-LesteTogoTokelauTongaTrinidad and
TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited
Arab EmiratesUnited KingdomUnited StatesUruguayUzbekistanVanuatuViet NamVirgin
Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern
SaharaYemenZambiaZimbabweSlovakiaVenezuela, Bolivarian Republic of
By submitting this form, you agree to our terms and to receiving communications
from Forcepoint, you acknowledge our privacy policy and you consent to the
processing of your data. You can unsubscribe at any time.
Conversion Type
TO THE POINT CYBERSECURITY
A podcast covering latest trends and topics in the world of cybersecurity
Listen now
MORE ARTICLES IN X-LABS
X-Labs
Previous
ONLINE TRAVELERS AT RISK: AGENT TESLA MALWARE ATTACKS TRAVEL INDUSTRY
Mayur Sewani
Prashant Kumar
|
Feb 26 2024
X-Labs
Next
EXPLORING THE METAMORFO BANKING TROJAN
Prashant Kumar
|
May 16 2024
Insights
Data Retention Policy Best Practices: A User’s Guide
X-LABS
GET INSIGHT, ANALYSIS & NEWS STRAIGHT TO YOUR INBOX
Conversion Prod Interest - Most Recent
sfcmpid
SF Source Campaign ID
Salesforce Campaign Name
Core/Non-core
GCLID - DO NOT USE
Work Email*
Country Picklist*
Select CountryAfghanistanAland
IslandsAlbaniaAlgeriaAndorraAngolaAnguillaAntarcticaAntigua and
BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBolivia,
Plurinational State ofBonaire, Sint Eustatius and SabaBosnia and
HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei
DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman
IslandsCentral African RepublicChadChileChinaChinese TaipeiChristmas IslandCocos
(Keeling) IslandsColombiaComorosCongoCongo, the Democratic Republic of theCook
IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe
IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern
TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard
Island and McDonald IslandsHoly See (Vatican City State)HondurasHong
KongHungaryIcelandIndiaIndonesiaIran, Islamic Republic ofIraqIrelandIsle of
ManIsraelItalyIvory CoastJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea,
Democratic People's Republic ofKorea, Republic ofKosovoKuwaitKyrgyzstanLao
People's Democratic RepublicLatviaLebanonLesothoLiberiaLibyan Arab
JamahiriyaLiechtensteinLithuaniaLuxembourgMacaoMacedonia, the former Yugoslav
Republic
ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMartiniqueMauritaniaMauritiusMexicoMicronesia,
Federated States ofMoldova, Republic
ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk
IslandNorwayOmanPakistanPalestinian Territory, OccupiedPanamaPapua New
GuineaParaguayPeruPhilippinesPitcairnPolandPortugalPuerto
RicoQatarReunionRomaniaRussian FederationRwandaSaint BarthélemySaint Helena,
Ascension and Tristan da CunhaSaint Kitts and NevisSaint LuciaSaint Martin
(French part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan
MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra
LeoneSingaporeSint Maarten (Dutch part)SloveniaSolomon IslandsSomaliaSouth
AfricaSouth Georgia and the South Sandwich IslandsSouth SudanSpainSri
LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyrian Arab
RepublicTaiwanTajikistanTanzania, United Republic
ofThailandTimor-LesteTogoTokelauTongaTrinidad and
TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited
Arab EmiratesUnited KingdomUnited StatesUruguayUzbekistanVanuatuViet NamVirgin
Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern
SaharaYemenZambiaZimbabweSlovakiaVenezuela, Bolivarian Republic of
By submitting this form, you agree to our terms and to receiving communications
from Forcepoint, you acknowledge our privacy policy and you consent to the
processing of your data. You can unsubscribe at any time.
Conversion Type
* Company
* Newsroom
* Work With Us
* Executive Team
* Blog
* Free E-Learning Courses
* Feedback
* All Products
* All Solutions
* Customer Stories
* Report a Vulnerability
* Contact Us
Terms & Conditions
Legal and Privacy
Manage Cookies
© 2024 Forcepoint
* LinkedIn
* Twitter
* Facebook
* YouTube
* RSS
We use essential cookies to ensure that our website functions as intended for
you. Additionally, Forcepoint requests your consent to use other cookies to
collect website usage data, deliver personalized advertising, and to enhance and
optimize your browsing experience.
To learn more about the cookies we use and how to manage them, visit our Cookie
Policy page; to find out how we use and protect personal data, please review our
Privacy Policy.
Accept All
Required Only
Manage Cookies
Schedule a Demo