Trellix details a DCRat campaign that hides a malware archive in an SVG file using HTML smuggling and process hollowing.
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT
At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a malware-as-a-service tool Target Users lured with a Colombian judicial theme Delivery vector Phishing email with a malicious SVG attachment Key capabilities Remote access, DLL sideloading, process hollowing, encrypted C2 Source Trellix Advanced Research Center (ARC) TL;DR Trellix analysts uncovered an active DCRat campaign that starts with a booby-trapped SVG file.
securityonline.info
August 18, 2026 at 1:02 AM
Trellix details a DCRat campaign that hides a malware archive in an SVG file using HTML smuggling and process hollowing.
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
Attackers use SVG files and HTML smuggling to distribute DCRat malware, bypassing security defenses. #CyberSecurity #Malware #DCRat #HTMLSmuggling #Phishing #SVGFiles https://thedailytechfeed.com/dcrat-campaign-uses-svg-files-to-deliver-malware-via-html-smuggling/
August 14, 2026 at 12:04 PM
Attackers use SVG files and HTML smuggling to distribute DCRat malware, bypassing security defenses. #CyberSecurity #Malware #DCRat #HTMLSmuggling #Phishing #SVGFiles https://thedailytechfeed.com/dcrat-campaign-uses-svg-files-to-deliver-malware-via-html-smuggling/
📄 Fake DocuSign sites hosted on GitCode are spreading malware via HTML smuggling. It’s a clever twist on a classic phish—don’t trust every “signature request.” 🧪📬
#PhishingAlert #HTMLSmuggling
#PhishingAlert #HTMLSmuggling
Fake DocuSign, Gitcode Sites Spread NetSupport RAT via Multi-Stage PowerShell Attack
Fake Gitcode and DocuSign sites are tricking users into running PowerShell scripts that install NetSupport RAT.
buff.ly
June 4, 2025 at 8:05 AM
📄 Fake DocuSign sites hosted on GitCode are spreading malware via HTML smuggling. It’s a clever twist on a classic phish—don’t trust every “signature request.” 🧪📬
#PhishingAlert #HTMLSmuggling
#PhishingAlert #HTMLSmuggling
~Zscaler~
Threat actors are using WebAssembly (WASM) to enhance HTML smuggling attacks, making malware delivery more evasive and difficult to detect.
-
IOCs: (None identified)
-
#HTMLSmuggling #ThreatIntel #WASM
Threat actors are using WebAssembly (WASM) to enhance HTML smuggling attacks, making malware delivery more evasive and difficult to detect.
-
IOCs: (None identified)
-
#HTMLSmuggling #ThreatIntel #WASM
Last-Mile Reassembly Attacks Evolve with WASM
www.zscaler.com
October 13, 2025 at 8:05 PM
~Zscaler~
Threat actors are using WebAssembly (WASM) to enhance HTML smuggling attacks, making malware delivery more evasive and difficult to detect.
-
IOCs: (None identified)
-
#HTMLSmuggling #ThreatIntel #WASM
Threat actors are using WebAssembly (WASM) to enhance HTML smuggling attacks, making malware delivery more evasive and difficult to detect.
-
IOCs: (None identified)
-
#HTMLSmuggling #ThreatIntel #WASM