Loading story…
A phishing campaign is delivering DarkCrystal RAT (DCRat) through weaponized SVG attachments that use HTML smuggling to drop a password-protected 7z archive onto Windows systems. Researchers said the lure impersonates a Colombian legal notice, “Resolución Denuncia Jurídica,” and presents a fake citizen consultation portal that instructs victims to open the downloaded archive with the password 1601, making the staged delivery appear legitimate while shifting malicious assembly into the victim’s browser to evade email inspection.
The attack chain uses double-Base64-encoded JavaScript embedded in the SVG, followed by DLL sideloading with files disguised as Brotli components, persistence through a Windows Registry Run entry, and process hollowing into AddInProcess32.exe. The final payload installs DCRat, a remote access trojan that supports encrypted command-and-control communications, anti-analysis checks, and repeated beaconing to 158[.]94[.]208[.]109, giving attackers sustained access to compromised hosts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A Gurucul threat research report described the DCRat campaign's use of DLL sideloading, process hollowing, trusted Windows utilities, and in-memory execution after SVG-based phishing. The report also published indicators of compromise including IP address 158.94.208.109 and five file hashes for detection.
In early 2026, Trellix identified a phishing campaign delivering DarkCrystal RAT (DCRat) after investigating a customer escalation. The campaign used SVG attachments with HTML smuggling and legal-notification lures themed as "Resolución Denuncia Jurídica."
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcetrellix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign has been identified targeting users in Colombia by impersonating official judicial notifications from the 17th Municipal Civil Court of the Bogotá Circuit. The attackers crafted emails in Spanish, leveraging local institutional details to increase the credibility of the lure. The phishing emails claim to contain a lawsuit notification and prompt recipients to open an attached SVG file. This SVG file is weaponized to initiate a multi-stage infection chain. Upon opening, the SVG file triggers the execution of a malicious HTA (HTML Application) file, which is a common technique for bypassing traditional email security filters. The HTA file then executes a VBS (Visual Basic Script) file, which in turn runs a PowerShell script. This PowerShell script acts as a downloader and loader, ultimately injecting the AsyncRAT remote access trojan into a legitimate Windows process to evade detection. AsyncRAT is a well-known remote access tool that allows attackers to gain persistent control over infected systems, exfiltrate data, and potentially deploy additional payloads. The campaign employs anti-virtual machine techniques to avoid analysis and uses persistence mechanisms to maintain access on compromised hosts. Security researchers have observed that the use of SVG files for initial infection is increasing, as these files can bypass some security controls due to their perceived harmlessness. The campaign demonstrates a high level of technical sophistication, chaining multiple scripting languages and file types to obfuscate the attack and evade endpoint detection. The malicious files have been identified and their MD5 hashes documented for threat intelligence sharing. Detection signatures have been updated by security vendors such as Quick Heal and Seqrite to identify and block the components of this attack. The campaign is notable for its targeted approach, focusing on Colombian users and leveraging local judicial terminology to increase the likelihood of success. The use of AsyncRAT as the final payload provides attackers with extensive capabilities for surveillance, data theft, and further lateral movement within affected organizations. Security teams are advised to educate users about the risks of opening unexpected attachments, especially those purporting to be from legal or government institutions. Organizations should also ensure that email security solutions are updated to detect SVG-based threats and that endpoint protection is capable of identifying the multi-stage infection chain. The incident highlights the evolving tactics of threat actors in using file formats and social engineering tailored to specific regions and institutions.
Jun 29, 2026
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026
Security researchers reported several unrelated **remote access trojan (RAT)** delivery campaigns using different initial access vectors and lures. Seqrite Labs described “**Operation Covert Access**,” a spear‑phishing operation targeting Argentina’s judiciary with a ZIP attachment containing a convincing court-resolution decoy; execution is triggered by a malicious `LNK` masquerading as a PDF, which launches hidden PowerShell to fetch additional stages from a GitHub repository, culminating in a custom **Rust-based RAT** that attempts to blend in by renaming itself (e.g., `msedge_proxy.exe`). Separately, AhnLab Security Intelligence Center reported South Korea-focused activity distributing **RemcosRAT** through illegal online gambling-related tools and trojanized *VeraCrypt* installers, using embedded malicious VBS scripts and a multi-stage chain that ultimately deploys a RAT capable of surveillance and data theft (e.g., keylogging, screenshot/webcam/mic capture, credential/data harvesting). Another campaign documented by ReliaQuest abused **LinkedIn private messages** to deliver a bundled legitimate application alongside a malicious DLL for **DLL sideloading**, enabling RAT deployment under the guise of a trusted process; the reporting emphasized that social platforms can serve as effective phishing channels beyond email and that the technique is portable to other commonly used business messaging platforms.
Jun 29, 2026