A new DCRat operation employs an old trick: it uses SVG files to hide malicious software within phishing emails. The scheme starts with fake notifications that urge recipients to open an attached SVG file, which appears harmless but actually contains hidden code for building and downloading a password-protected archive directly into the victim's browser. Researchers discovered that cybercriminals employed a combination of social engineering tactics, hidden browser code injection, DLL sideloading, and process hollowing to embed DCRat malware within a trusted Windows application.
According to a report from Trellix shared with ZeroOwl (ZeroOwl), DCRat, also known as DarkCrystal RAT, provides unauthorized access to infected systems, allowing operators to execute commands, gather data, maintain control over the compromised machines, and communicate with command-and-control servers.
A phishing campaign disguised malware using DCRat, with the lure titled "Resolución Denuncia Jurídica." The SVG attachment mimics a Colombian judicial notification, prompting recipients to open it and view a fake citizen consultation portal that appears official. Inside the SVG, there's double Base64-encoded JavaScript script embedded within a browser Blob function, which decodes its contents and reconstructs an archive in memory before saving it as DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z.
This method is called HTML smuggling. Teams must also correlate endpoint behavior with network activity, validate file integrity, hunt for suspicious Registry Run entries, and maintain patch hygiene.
