DCRat Campaign Leverages SVG and HTML Smuggling for Malware Delivery
A new DCRat campaign employs HTML smuggling within SVG files to deliver malware, tricking users into downloading password-protected archives assembled in the browser.
A sophisticated DCRat campaign has been identified, utilizing a novel approach that embeds malware archives within Scalable Vector Graphics (SVG) files through HTML smuggling techniques. The campaign commences with phishing emails, often impersonating official legal notifications, that instruct recipients to open an attached SVG file. While SVG files are typically used for graphics, in this instance, the file contains malicious code designed to construct and download a password-protected archive directly within the user's web browser.
Researchers at Trellix uncovered this campaign after investigating a customer escalation. They observed that the threat actors combined social engineering tactics with advanced techniques such as HTML smuggling, DLL sideloading, and process hollowing. This multi-stage approach aims to disguise the DCRat malware, also known as DarkCrystal RAT, by embedding it within legitimate Windows processes, thereby granting attackers remote access and facilitating data exfiltration.
The phishing lure specifically mimics a Colombian judicial notification titled "Resolución Denuncia Jurídica." Upon opening the SVG attachment, victims are presented with a fake citizen consultation portal, designed to appear official and lower suspicion. A subsequent screen claims a file download has completed and provides a password, "1601," to unlock the archive, further lulling the user into a false sense of security.
The malicious payload is concealed within the SVG file as double Base64-encoded JavaScript. When executed, this script decodes its contents and utilizes a browser Blob function to reconstruct a 7z archive in memory. This archive is then saved locally with a filename that mirrors the deceptive notification, such as "DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z." This HTML smuggling method is effective because it allows attackers to hide malicious downloads within files that email security gateways might classify as benign images, rather than executable or script files.
Once the archive is extracted, it contains a decoy executable alongside several DLL files designed to mimic legitimate Brotli compression components. The attackers exploit the Windows DLL search order mechanism. When the decoy program is launched, the operating system inadvertently loads the attacker-supplied DLLs from the same directory, a technique known as DLL sideloading. This makes the malicious activity appear associated with a legitimate application, complicating initial detection efforts.
Following DLL sideloading, the loader establishes persistence through a Windows Registry Run entry and then decrypts its next-stage payload in memory. This decrypted payload initiates the legitimate Windows process "AddInProcess32.exe" in a suspended state. The attacker then replaces the original memory of this process with their malicious code before resuming its execution. This process hollowing technique allows the DCRat malware to operate under the guise of a trusted Windows component, maintaining its remote control capabilities undetected.
The final DCRat payload is equipped with features for encrypted communication, anti-analysis checks, persistence mechanisms, and repeated attempts to connect to its command-and-control (C2) infrastructure. Although the identified C2 server was unavailable during analysis, the malware continued its efforts to re-establish a connection, underscoring its persistent nature.
To mitigate this threat, organizations are advised to enhance the scrutiny of SVG and HTML attachments, inspect unexpected archive downloads, and monitor for abnormal DLL loading and process creation. Correlating endpoint behavior with network activity, validating file integrity, hunting for suspicious Registry Run entries, and maintaining up-to-date patch hygiene are also crucial. Furthermore, ongoing security awareness training remains vital, as the success of this attack chain still relies on user interaction, such as opening the initial attachment and launching the extracted file.