DCRat Malware Campaign Uses HTML Smuggling in SVG Files

Key Takeaways

• A new DCRat (DarkCrystal RAT) campaign is actively exploiting HTML smuggling via SVG image files.
• The attack chain begins with phishing emails disguised as legal notifications, leading to the download of a password-protected archive containing the DCRat malware.
• Attackers employ sophisticated techniques including HTML smuggling, DLL sideloading, and process hollowing to evade detection and maintain persistence.
• The DCRat provides remote access, enabling command execution, data exfiltration, and persistent control over compromised systems.
• Organizations should enhance email and attachment scrutiny, implement robust endpoint monitoring, and conduct regular security awareness training.

DCRat Campaign Leverages HTML Smuggling in SVG Files for Covert Malware Delivery

A sophisticated new campaign is distributing the DCRat (DarkCrystal Remote Access Trojan) by exploiting a common image format, SVG, to conceal a malicious archive. The attack initiates with phishing emails that impersonate legal correspondence, urging recipients to open an attached SVG file.

While SVG files are typically used for graphics and often perceived as innocuous, in this campaign, they contain embedded code. This hidden script is designed to construct and download a password-protected archive directly within the victim’s web browser, bypassing traditional email security scans.

Security researchers at Trellix said in a report that they uncovered this operation following a customer incident in early 2026. Their investigation revealed a multi-stage attack that combines social engineering with advanced technical evasion tactics, including browser-based code execution, DLL sideloading, and process hollowing, to embed DCRat within legitimate Windows processes.

The evolving distribution methods of DCRat underscore how threat actors continuously adapt their delivery mechanisms to circumvent defenses and exploit new vectors.

HTML Smuggling Hides Malware Archive

The phishing emails in this campaign are meticulously crafted to resemble official Colombian judicial notifications, specifically titled “Resolución Denuncia Jurídica.” When a user opens the attached SVG file, it initially displays a fake citizen consultation portal, lending an air of authenticity to the malicious communication.

Interacting with this deceptive page redirects the victim to another screen, falsely claiming a file download has been completed. Crucially, this page also provides the password “1601,” encouraging the user to open the downloaded archive and thereby reducing suspicion through a carefully staged interaction.

Underneath its visual façade, the SVG file contains double Base64-encoded JavaScript. This script decodes its contents and leverages a browser’s Blob function to reconstruct a 7Zip archive in memory. This archive is then saved to the victim’s system as DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z.

This technique, known as HTML smuggling, is highly effective because it allows attackers to embed a malicious payload within a file type, such as an SVG image, that email security gateways might not scrutinize as rigorously as executables or scripts. The malicious content is assembled locally on the user’s machine after interaction, rather than being directly transmitted in a format easily flagged by security tools. This method shifts a critical part of the attack into the browser environment, where the malicious archive is only materialized after the recipient engages with the attachment.

The campaign highlights that SVG files, despite being graphical, can contain active web content. Organizations must therefore treat unexpected image attachments with the same level of caution applied to HTML files, archives, and executable downloads, given recent trends in weaponized SVG file campaigns.

DLL Sideloading Masks DCRat Execution

The downloaded 7Zip archive contains not only the DCRat payload but also a decoy executable and several DLL files designed to mimic legitimate Brotli compression components. When the victim launches the decoy program, it attempts to load libbrotlidec.dll and libbrotlienc.dll. The attackers exploit Windows’ DLL search order, ensuring that the malicious libraries, supplied in the same directory as the decoy, are loaded instead of legitimate system files.

This technique, known as DLL sideloading, is a common evasion tactic. It allows malicious activity to appear as if it originates from a trusted application, making early detection by security systems significantly more challenging.

Following successful DLL sideloading, the loader creates a hidden folder in the user’s directory, copies its components there, and establishes persistence by creating a Windows Registry Run entry. It then decrypts its next-stage payload directly in memory, minimizing the footprint of malicious data written to disk and further complicating forensic analysis.

The final stage of the infection involves process hollowing. The payload initiates AddInProcess32.exe in a suspended state, overwrites its legitimate memory space with the DCRat code, and then resumes the process. This allows DCRat to execute under the guise of a legitimate Windows component while retaining full remote-control capabilities.

The DCRat payload itself employs encrypted communication, includes anti-analysis checks, implements persistence mechanisms, and repeatedly attempts to connect to its command-and-control (C2) infrastructure. Although the C2 server was offline during Trellix’s analysis, the malware persistently tried to establish a connection, demonstrating its robust design for maintaining control.

What You Should Do

• Strengthen Email and Attachment Screening: Enhance security gateway rules to meticulously inspect SVG and HTML attachments. Implement sandboxing for all unexpected archive downloads.
• Monitor Endpoint Behavior: Actively monitor for abnormal DLL loading, suspicious process creation (especially process hollowing), and any unexpected network connections from seemingly legitimate applications.
• Conduct Security Awareness Training: Regularly educate employees on the dangers of phishing emails, the importance of verifying sender legitimacy, and the risks associated with opening unexpected attachments, even those appearing as common image files. Emphasize caution with any requests to download or open password-protected archives.
• Implement Advanced Threat Protection: Utilize Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) solutions capable of detecting sophisticated evasion techniques like HTML smuggling, DLL sideloading, and process hollowing.
• Validate File Integrity: Implement measures to validate the integrity of downloaded files and monitor for suspicious modifications to system components.
• Monitor Registry Run Entries: Regularly audit and monitor Windows Registry Run entries for any unauthorized or suspicious additions that could indicate persistence mechanisms.
• Maintain Patch Hygiene: Ensure all operating systems, applications, and security software are kept up-to-date with the latest security patches to mitigate known vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.