FHN 
A new DCRat malware campaign is using malicious SVG files and HTML smuggling to bypass traditional email defenses and deliver a remote access trojan to Windows systems.
The campaign begins with phishing emails disguised as legal or judicial notifications. Instead of attaching an executable file, attackers use an SVG image, making the initial attachment appear less suspicious.
Security researchers at Trellix identified the campaign while investigating a customer incident in early 2026. Their analysis found a multi-stage infection chain combining social engineering, browser-based payload generation, DLL sideloading, and process hollowing.
A Malicious SVG Disguised as a Legal Notification
The campaign uses a phishing message that impersonates a Colombian judicial notification titled “Resolución Denuncia Jurídica.”
When the recipient opens the SVG attachment, it displays a fake consultation page designed to resemble an official service.
The page then claims that a document is available for download and provides a password for the archive.
While the process appears legitimate to the user, the SVG contains encoded JavaScript that performs the actual malicious activity.
The script reconstructs a password-protected 7-Zip archive directly on the victim’s system and saves it locally.
This technique is known as HTML smuggling.
Rather than sending the malicious archive directly, the attacker uses the browser to assemble it on the endpoint. This can make detection more difficult because security controls inspecting the original email may initially see only an SVG attachment.
From SVG to DCRat
Once the archive is extracted and the included executable is launched, the attack moves into the Windows environment.
The malware uses DLL sideloading, placing malicious DLL files alongside a legitimate-looking executable. When the executable runs, Windows loads the attacker-controlled libraries.
The campaign then establishes persistence through a Windows Registry Run entry and decrypts additional code in memory.
The next stage uses process hollowing. A legitimate Windows process is started in a suspended state, its memory is replaced with malicious code, and the process is then resumed.
This allows DCRat to operate within what appears to be a legitimate Windows process, making behavioral detection and investigation more challenging.
What DCRat Can Do
DCRat, also known as DarkCrystal RAT, is a remote access trojan that provides attackers with control over compromised systems.
Its capabilities can include:
- Remote command execution
- System and user information collection
- Data theft
- Persistence
- Communication with command-and-control infrastructure
- Remote access to compromised systems
The malware also uses encrypted communications and anti-analysis techniques to make detection and investigation more difficult.
The Attack Chain
The campaign demonstrates how several techniques can be combined into a single infection:
Phishing Email → Malicious SVG → HTML Smuggling → Malware Archive → DLL Sideloading → Process Hollowing → DCRat
Each stage is designed to make the next step less obvious.
The attachment looks like an image.
The webpage looks legitimate.
The archive appears to contain a document.
The executable appears to be part of a normal application.
Together, these techniques create a sophisticated delivery chain.
How Organizations Can Reduce the Risk
Security teams should not automatically treat SVG files as harmless image attachments. Unexpected SVG files should be inspected with the same caution applied to HTML files, archives, and executable content.
Organizations should also:
- Inspect suspicious SVG and HTML attachments
- Monitor unexpected archive creation and extraction
- Detect unusual DLL loading activity
- Monitor Registry Run entries for persistence
- Look for suspicious process injection or hollowing
- Correlate endpoint and network telemetry
- Keep operating systems and security tools updated
- Train employees to verify unexpected legal and document-related emails
Conclusion
The DCRat campaign highlights an important shift in malware delivery. Attackers are increasingly using legitimate-looking file formats and browser functionality as part of multi-stage infection chains.
An SVG may appear to be nothing more than an image, but its contents can introduce an entirely different level of risk.
For security teams, the key is to look beyond the file extension and understand what happens when the file is opened, what processes it creates, and what network activity follows.
A harmless-looking attachment can be the first step in a much larger compromise.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Email hash | F205AB7E6AEFC10B9833D1A9A91BAD02 | ENVIO DE RESOLUCION DENUNCIA JUDICIAL RA-093-7397.eml |
| SVG hash | A3A471F1C7A605DD34AF49EF075E1251 | DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.svg |
| 7Zip hash | 13df3e065c421436bf0ac6fed3f9bb7f | DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z |
| DLL hash | d4bb45d3aef7a9161df4cadaeeba6a39 | libbrotlienc.dll |
| PE hash | Acef69c68b8c3d3c3e1e53196a26ca60 | Client.exe DCRat payload |
| IP address | 158[.]94[.]208[.]109 | Command-and-control server |
About the Author
