The Click Happens Before the Brain Catches Up
At a previous employer, the security team sent a company-wide email about cybersecurity awareness training — PowerPoint slides, some slides about phishing, the usual. I sat through it. A few days later an email arrived. It looked exactly like something the IT department would send. I clicked the link without thinking.
It was a phishing simulation. The IT security team had sent it. I had just failed the test.
The email explaining what happened was clear: this was a controlled exercise, but if it happened again with a real phishing email, there could be disciplinary consequences. I immediately emailed tech support to let them know what had happened — not because I thought I had done something technically wrong, but because that is what you are supposed to do. Report it. I knew within seconds that the click had been a mistake.
What I remember most clearly is not the embarrassment. It is the speed. The click happened before any evaluation did. I read the email, I saw a link, and my hand moved. The training I had just completed — the slides about what phishing looks like, the warnings about suspicious links — did not fire in time. The action was already done.
That gap between the click and the realization is not a character flaw. It is how human cognition works under familiar context. When something looks like what we expect — an email from IT, a reply to a conversation we started, a file from a vendor we know — the brain processes it as safe before the analytical layer engages. DarkGate is specifically engineered to exploit that gap. Not by fooling your analytical brain. By bypassing it entirely.
What DarkGate Actually Is
DarkGate is a malware loader — a piece of software whose job is to get onto your machine and then download and run whatever the attacker wants next. It has been active since 2018. Until 2023 the developer kept it private, using it exclusively for their own operations. Then they began renting it out to affiliates at $1,000 per day, $15,000 per month, or $100,000 per year.
That pricing is not a typo. DarkGate is a premium product marketed to other criminals as "the ultimate tool for pentesters/redteamers" — a framing that provides cover for what it actually is. At $100,000 per year, the people buying it are not script kiddies. They are organized threat actors with budgets, infrastructure, and specific targets.
What the price buys: hidden remote desktop access, Windows Defender exclusions, browser history theft, reverse proxy, Discord token harvesting, cryptocurrency mining, and the ability to deliver any secondary payload the attacker chooses — ransomware, additional stealers, persistent backdoors. DarkGate is the delivery mechanism. What comes after depends entirely on who bought it and what they want.
DarkGate in ArgusX threat data (September 2026): 14 OTX pulses attributed to DarkGate across threat intelligence feeds. Top targeted industries: Government (327 pulses across all actors), Finance (252), Technology (152). No existing Sublime Security detection rule covers the DarkGate thread hijacking delivery pattern.
The Thread Is the Attack
Most phishing emails create context from scratch. They invent a reason for you to click — a fake invoice, a security alert, a package notification. The social engineering is in the email itself. You have to be persuaded by something you have never seen before.
DarkGate does something different. It finds context that already exists.
The attack works like this: the attacker compromises an Office 365 account — through credential phishing, password spraying, or purchasing stolen credentials from an infostealer log. Once inside the account, they search the mailbox for email threads with external contacts. They find a real conversation between the account owner and a vendor, a colleague, a client. They reply to that thread with a malicious link — usually a ZIP file hosted on SharePoint, using filenames like "Updated Invoice Terms.zip" or "Changes to the vacation schedule.zip" — and send it from the compromised legitimate account.
The recipient gets a reply to a conversation they actually had. From a sender they actually know. With a file that fits the context of what they were discussing. Their spam filter sees a reply from a known contact. Their security tool sees a familiar sender domain passing SPF, DKIM, and DMARC. Nothing triggers. The email lands in the inbox looking exactly like the real thing — because the account that sent it is real.
The detection gap: Sublime Security's existing thread hijacking rule (vendor_impersonation_thread_hijack.yml) detects typosquatted domains with BEC financial intent — a fake lookalike domain impersonating a vendor to redirect a payment. DarkGate thread hijacking uses the real compromised account, not a lookalike. The sender domain passes every check. There is no typosquat to detect. No financial intent signal. The existing rule does not fire. A companion rule targeting thread replies with archive attachments from first-contact senders is in development.
Why Training Does Not Help
I sat through cybersecurity training at 605.tv. I knew what phishing looked like — the generic sender, the urgency, the suspicious link. I clicked anyway. Not because the training was bad. Because the test email did not look like what the training described. It looked like something from IT. My mental model of "phishing" did not include "email from the IT department."
DarkGate thread hijacking exploits the same gap, but at a deeper level. Security awareness training teaches people to be suspicious of unexpected emails from unknown senders. It does not teach people to be suspicious of a reply to a conversation they started with a vendor they have worked with for two years. That is not in anyone's mental model of "suspicious."
The reason is structural. Thread hijacking attacks do not look like phishing attacks. They look like the continuation of a normal business relationship. The suspicious signals that training focuses on — generic sender, wrong domain, urgency language, unexpected attachment — are not present. The email is contextually appropriate. The sender is known. The file fits the conversation. Everything the training told you to look for is absent.
What actually helps: Treat any archive file (ZIP, RAR, 7z) in an email — even from a known sender in an existing thread — as requiring verification before opening. Call the sender. Check via a separate channel. The one signal that is always present in thread hijacking is the archive attachment. No legitimate business process requires you to open a ZIP file from an email without verifying it through a second channel first. That rule holds even when the email looks completely normal.
DarkGate malware history and pricing sourced from Telekom Security CTI (August 2023), ZeroFox (June 2023), and TrueSec threat research (October 2023). Thread hijacking delivery pattern documented by Kroll (October 2023), Telekom Security (August 2023), and Microsoft Teams delivery variant by TrueSec. DarkGate OTX pulse data via ArgusX threat intelligence platform (September 2026). Companion detection rule: gist.github.com/yana-ivanov. The 605.tv phishing simulation experience is the author's own. This field note represents independent research produced for educational purposes.