A new DCRat campaign is using a familiar image format to hide a dangerous malware archive. The operation begins with phishing emails that pose as legal notifications and urge recipients to open an attached SVG file.

The attachment looks harmless because SVG files are commonly used for graphics. In this case, however, the file contains hidden code that builds and downloads a password-protected archive directly inside the victim’s browser.

Analysts at Trellix identified the campaign after investigating a customer escalation in early 2026.

The researchers found that the attackers combined social engineering, hidden browser code, DLL sideloading, and process hollowing to place DCRat inside a trusted Windows process.

DCRat malware distribution methods have also shown how attackers continue to adapt the remote-access tool for different delivery channels.

Trellix said in a report shared with Cyber Security News (CSN) that the DCRat, also known as DarkCrystal RAT, gives operators remote access to infected systems.

That access can be used to run commands, collect data, maintain control, and communicate with a command-and-control server.

The campaign highlights how seemingly ordinary files can become the first step in a much larger compromise.

DCRat Campaign Hides Malware Archive

The phishing lure impersonates a Colombian judicial notification titled “Resolución Denuncia Jurídica.”

When a recipient opens the SVG attachment, it displays a fake citizen consultation portal designed to make the message appear official.

Clicking the page redirects the victim to another screen that claims a file download has completed.

The page provides the password “1601,” encouraging the recipient to open the archive and lowering suspicion through a staged, believable process.

Behind the visual content, the SVG includes double Base64-encoded JavaScript.

The script decodes its contents and uses a browser Blob function to reconstruct an archive in memory before saving it as DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z.

This method is known as HTML smuggling. It allows criminals to conceal a malicious download within a file that email security tools may treat as an image, rather than as an executable or script.

Similar HTML smuggling delivery tactics have been used to build harmful content locally after a victim opens an attachment.

The tactic matters because it shifts part of the attack into the browser. Security tools inspecting an incoming email may see only an SVG attachment, while the malicious archive is assembled after the recipient interacts with it.

SVG files can contain active web content despite being presented as graphics.

Recent weaponized SVG file campaigns illustrate why organizations should treat unexpected image attachments with the same caution as HTML files, archives, and executable downloads.

DLL Sideloading Masks DCRat

The downloaded archive contains a decoy executable and several DLL files made to resemble Brotli compression components.

The main executable loads libbrotlidec.dll and libbrotlienc.dll, allowing the attackers to exploit Windows DLL search behavior.

When the victim launches the decoy program, the operating system loads the attacker-supplied libraries from the same folder.

This DLL sideloading technique makes malicious activity appear connected to a normal application and can make early detection more difficult.

The loader creates a folder in the user directory, copies files into it, and establishes persistence through a Windows Registry Run entry.

It then decrypts its next-stage payload in memory, reducing the amount of clearly malicious material written to disk.

The payload starts AddInProcess32.exe in a suspended state, replaces its original memory with malicious code, and resumes the process.

This process hollowing method lets DCRat run under the name of a legitimate Windows component while retaining remote-control capabilities.

The final DCRat payload uses encrypted communication, anti-analysis checks, persistence controls, and repeated connection attempts to its command-and-control infrastructure.

The researchers noted that the identified server was unavailable during analysis, but the malware continued trying to reconnect.

Organizations should strengthen screening of SVG and HTML attachments, inspect unexpected archive downloads, and monitor abnormal DLL loading and process creation.

Teams should also correlate endpoint behavior with network activity, validate file integrity, hunt for suspicious Registry Run entries, and maintain patch hygiene.

Awareness training remains important because this chain still depends on a person opening the attachment and launching the extracted file.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world