Divulging the DNS Secrets of DarkSpectre

Koi Security has been monitoring a threat group known as DarkSpectre for more than a year. The group has been linked to multiple malware campaigns involving Zoom Stealer, ShadyPanda¹, and GhostPoster, impacting more than 8.8 million users over seven years.

In a newly identified campaign affecting 2.2 million users, DarkSpectre leveraged a GhostPoster-linked Opera browser extension with nearly 1 million installs as of December 2025. Koi Security identified 20 IoCs² tied to this activity. After filtering legitimate infrastructure using Jake AI, we analyzed 15 IoCs in total, leading to the following findings:

• 57 unique client IP addresses communicated with one domain identified as an IoC
• 8,579 email-connected domains, three of which turned out to be malicious
• Three additional IP addresses, two of which turned out to be malicious
• Five IP-connected domains, one of which turned out to be malicious
• 15 string-connected domains
• 250 string-connected subdomains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://main.whoisxmlapi.com/threat-reports/illuminating-shadypanda-dns-infrastructure-facts 
• [2] https://www.koi.ai/blog/darkspectre-unmasking-the-threat-actor-behind-7-8-million-infected-browsers#heading-7