On September 22, 2026, Gartner published a survey of 297 senior security leaders, CISOs or equivalent, run from March to May 2026. The headline number was about deepfakes: 41% "reported at least one social engineering incident involving a deepfake during an employee audio call," and 36% during a video call. The number we care about sat lower in the release. Per Gartner, "Seventy-nine percent of CISOs surveyed reported at least one e-mail phishing, spear-phishing, or business e-mail compromise incident in the last 12 months." Deepfakes got the headline. Email got four out of five of them.
On the same day, Huntress published a write-up that shows what that 79% looks like in practice, and why it is not going away. Malware that once arrived behind zero-day exploits is now arriving the cheap way: a plain email with a link.
Malware that once rode zero-days, and how it arrives now
The malware is called DarkMe. Per Huntress, it is "a Visual Basic 6 (VB6) spy-RAT previously attributed to the financially-motivated APT tracked as Water Hydra and the EvilNum-led Operation DarkCasino," a group whose campaigns Huntress describes as "typically financially motivated, targeting forex traders, stock-trading forums, online gambling platforms, and cryptocurrency users." It earned its reputation the expensive way. In Huntress's words, "Two years ago, DarkMe developed a reputation by leveraging two separate zero days to deliver its malware:" the WinRAR flaw CVE-2023-38831 and CVE-2024-21412, which Huntress describes as a Windows Defender SmartScreen bypass. Zero-days are scarce, costly, and they lose their value once the vendor ships a patch and targets apply it.
On August 31, 2026, Huntress "spotted the DarkMe malware in two separate incidents affecting different organizations." No exploit this time. Per Huntress, "The delivery came through a link in a plain old social engineering malspam email." Huntress shows a screenshot of the email but does not describe the pretext or the claimed sender in its write-up, and it names no industry or country for the two victims, only that the file reached two Huntress customer environments. (Help Net Security, which interviewed Huntress's Andrew Brandt, adds the caveat that Huntress "can't confirm that this attack was carried out by Water Hydra.")
Here is the trick, in Huntress's own sentences. "Although the link in the email pointed to https://readonline365[.]com/view/image.png, a URL for a graphics file," Huntress writes, "the webserver delivered image.pif, a Windows executable." A .pif file, per Huntress, is "a relic of the DOS era," short for "program information file," and "Modern Windows systems execute .pif files as a program, regardless of what the extension implies (or what the icon shows)." The result: "The users simply double-clicked and downloaded the file, not realising what it was."
That one-megabyte file had one job. Per Huntress, "The PIF's only job is to invoke the Microsoft installer, msiexec, to download and execute an .msi installer file" from a second attacker-controlled domain. From there the chain installs the DarkMe trojan and hides it inside a signed Microsoft program. Once running, Huntress says the telemetry "pointed to capabilities that line up with previously reported DarkMe tradecraft," including "Cryptocurrency wallet theft (MetaMask, Ledger, Exodus, Trezor, Phantom)," "Screenshot capture via GDI+," antivirus enumeration, and "Full file manipulation and arbitrary command execution over a custom TCP channel." In plain terms: it can read what is on the screen, take files, and run commands, on a machine whose owner clicked on what looked like a picture.
Why the campaign downgraded to a plain email
This is the paragraph worth reading twice. Per Huntress: "Dropping the zero days didn't weaken this campaign. Instead, it made the operation cheaper, highly scalable, and easier to point at a broader audience." And: "That explains the shift in targeting from niche forex traders to everyday corporate users."
Huntress puts the reason in one line: "In 2026, users are still clicking links in unsolicited emails." Followed by: "As long as these old-school phishing tactics keep working, adversaries have no reason to burn expensive exploits." Huntress is careful to add that it is "not suggesting that DarkMe is somehow less sophisticated in its capabilities than two years ago"; it simply "doesn't have to be."
Our reading, and it is ours, not Huntress's: "everyday corporate users" describes the people who work at a 10 to 100 person business. A zero-day was worth spending on a forex trader with a funded account. A plain email is cheap enough to send to a bookkeeper, an office manager, or an estimator, and to thousands of them. When the tooling gets cheaper, the target list grows downward, toward businesses that were not worth the effort before. Gartner's 297 respondents were CISOs or equivalent; Gartner does not say how large or small their organizations were. Our reading is that if four in five organizations with a security leader took a phishing or BEC hit in a year, a business with no security team is not in a better position.
The two stories fit together. Gartner Director Analyst Craig Porter said it plainly: "Most attacks will continue to rely on users, stolen credentials, weak recovery processes, and familiar technical methods." The DarkMe campaign is the familiar method, sent to a wider list. The FBI's 2025 IC3 report counted 191,561 phishing and spoofing complaints and $3.05 billion in reported business email compromise losses, and both begin with something that reached a person, usually a message.
Where the usual defenses sit, and where the gap is
It helps to know what your existing tools do with a link to a disguised program, and we are going to quote Microsoft rather than guess.
Microsoft 365's built-in filtering can block dangerous attachments by type. Per Microsoft Learn, the common attachments filter means "Messages that contain the specified file types are automatically rejected (default) or quarantined based on the policy setting," and the default list includes .pif, along with .exe, .msi, .scr and others. One catch, per Microsoft Learn: the filter is on by default "in the default anti-malware policy in organizations created after December 1, 2023," so an older tenant may have it off unless an admin turned it on, which is worth checking. That is a good control, and it did not apply here. Per Huntress, the delivery came through a link, and the link pointed to a page that called itself image.png. The attachment filter had no file to inspect.
Link checking is where the plans differ. Per Microsoft Learn, Safe Links provides "time-of-click verification of URLs and links in email messages," including, when the setting is on, "real-time scanning of links, including links in email messages that point to downloadable content." Safe Links is part of Microsoft Defender for Office 365; Plan 1 is included with Microsoft 365 Business Premium, and per Microsoft Learn, Defender for Office 365 "is also available as an add-on subscription to many Microsoft 365 subscriptions with cloud mailboxes." Microsoft's plan comparison page lists "URL time-of-click protection" for Business Basic and Business Standard, and the full Defender for Office 365 Plan 1 for Business Premium. Microsoft Learn also says Microsoft 365 "uses several URL blocklists that help detect known malicious links within messages." So the check a link gets depends on the plan and the settings, and Microsoft's pages do not say how any of them treat a link that serves a .pif; we are not going to guess.
Then Windows itself. Per Microsoft, SmartScreen checks "downloaded files against a list of files that are well known and downloaded frequently," and "If the file isn't on that list, Microsoft Defender SmartScreen shows a warning, advising caution." Whether those two users saw a warning and clicked through it, Huntress does not say. What Huntress does say about the .pif format is worth repeating to your staff: "Legitimate use on modern Windows is essentially nonexistent."
What to do about it, yours and ours
Three moves are yours, or your IT provider's, and one is ours.
First, the technical alerts Huntress recommends, which an endpoint tool with custom rules can carry. Huntress's list includes: "Alert on execution of .pif files," "Alert on msiexec fetching a remote MSI over HTTP/S," and "Alert on signed Microsoft binaries such as clspack.exe running from %AppData% rather than System32/SysWOW64." On the network side, Huntress writes that "Flagging or blocking outbound egress to TCP 7712 provides a simple, low-noise signal for identifying active C2 sessions from this RAT," and lists the domains and address to block: onlineview365[.]com, readonline365[.]com, and thatawful[.]boutique / 67.43.50[.]11. If your IT provider runs your endpoint protection, forward them the Huntress post; the indicators are in it.
Second, if a machine ran that file, Huntress's cleanup guidance is to isolate the host, remove the artifacts, and "Reset credentials for the affected user, and treat any cryptocurrency wallet used on the host as compromised." A password reset alone is not a cleanup when a remote access trojan has been on the box.
Third, the people move, and here Gartner's advice is the right one: "Train employees and approvers to pause, verify, and report high-risk requests" whether the request "arrives through e-mail, voice, video, collaboration tools, or an AI application." A link that says image.png and downloads a program instead is a report, not a shrug. Make it easy to report and make it safe to be wrong.
Fourth, ours: the email. This campaign, like the device code phishing we wrote about yesterday, starts with a message reaching a person. That is the layer we work in. Our Managed Email Security runs Check Point Email Security, which Check Point describes as "an API-based inline protection service" that intercepts email and "sends the email to Check Point's ThreatCloud for analysis before the email is delivered to the recipient," in Prevent (Inline) mode, which per Check Point "scans the emails prior to delivery to the user." Per Check Point's documentation, the anti-phishing engine "analyzes various components of an email, such as attachments, links, sender reputation, domain analysis, OCR, URLs behind QR code, and many more," and Click-Time Protection "replaces links in the email's body and attachments" so that at the moment of the click, per Check Point, "the website behind the link is inspected to ensure it is not a phishing website." And behind the engines there is a person: we tune the policies for your organization, we run the quarantine, and we look at what your staff report.
We will not tell you a filter would have caught DarkMe. Huntress does not say what email security the two victims had. Check Point's Click-Time Protection documentation describes inspecting the website behind a link for phishing indicators and known malicious reputation, and we are not going to claim more for it than the documentation does. And Microsoft's own benchmark reports that Defender missed 221 high-severity threats per 1,000 protected users from May through July 2026, the best result in the comparison it published. What we will say is that a cheap, high-volume campaign is the kind that carries reusable signals, that a second layer with different engines sees mail differently than the first, and that a person reviewing what got through each business day improves your odds. When attackers stop paying for exploits and start paying for email volume, the email layer is where the money is being spent against you.
See what is reaching your inboxes now
Our free two-week email security assessment connects the platform in Monitor only mode, which per Check Point "provides visibility into the cloud-hosted email" and, the way we run the assessment, quarantines, moves and deletes no mail, so your current filter keeps working. Each business day we review what it flagged against what was delivered: the "view the image" links, the password-expiration notices, the invoices from a domain registered last month. At the end you get a written report and a walkthrough with your own examples, and you keep the report whether or not you sign. Not a pen test or vulnerability scan; it is a two-week look at your actual mail.
The year-end offer
Managed Email Security is $8 per user per month, license plus fully managed service. Through December 31, 2026, new customers who sign a 12-month agreement get 20% off, which is $6.40 per user per month; registered 501(c)(3) nonprofits get 30% instead, $5.60. New customers only, no onboarding fee, and the SaaS security posture report within your first 90 days at no charge. Full terms are in the year-end offer post, and the service is described on our services page.
We work with small and medium businesses and nonprofits nationwide, including Washington DC, Northern Virginia, and Maryland. To start the free assessment, book a free 15-minute call.
Sources: Huntress, "DarkMe Email Campaign Broadens Targeting For APT RAT," James Northey and Andrew Brandt (Sept 22, 2026); Help Net Security, "DarkMe RAT trades zero-days for plain phishing emails" (Sept 23, 2026); Gartner press release, "Gartner Survey Finds 41% of CISOs Reported at Least One Social Engineering Incident Involving a Deepfake in the Past 12 Months" (Sept 22, 2026); Microsoft Learn: Anti-malware protection in EOP (Jun 2026), Recommended settings for EOP and Microsoft Defender for Office 365, Exchange Online Protection overview, Safe Links in Microsoft Defender for Office 365 (May 2026), Microsoft Defender for Office 365 service description and overview, Microsoft Defender SmartScreen (Apr 2026); Microsoft 365 business plan comparison page; Microsoft Security blog, "Improving email security outcomes with real-world Microsoft Defender insights" (Sept 17, 2026); FBI, 2025 IC3 Annual Report; Check Point Email Security administration guide (Introduction, Anti-Phishing engine, Click-Time Protection, Email Protection modes, Threat Detection Policy).
