DCRat Malware Concealed in SVG via HTML Smuggling

A sophisticated DCRat malware campaign has been detected utilizing SVG files to clandestinely deliver harmful software. This operation initiates with phishing emails disguised as legal communications, urging recipients to open a seemingly innocuous SVG attachment.

The Mechanism Behind the Attack

While SVG files are typically used for graphics, this particular file is embedded with concealed code that constructs and retrieves a password-protected archive within the user’s browser. Trellix analysts uncovered this campaign during an investigation in early 2026, revealing a blend of social engineering, browser code manipulation, DLL sideloading, and process hollowing to embed DCRat within a secure Windows process.

DCRat, also known as DarkCrystal RAT, is a tool providing remote access to infected systems. According to a report by Trellix, shared with Cyber Security News, this access allows attackers to execute commands, gather information, maintain system control, and communicate with command-and-control servers. This campaign exemplifies how ordinary files can initiate extensive security breaches.

Phishing Tactics and HTML Smuggling

The phishing emails mimic a Colombian judicial notice titled “Resolución Denuncia Jurídica.” When the SVG attachment is opened, it reveals a counterfeit citizen consultation portal, aiming to appear official. The recipient is then redirected, receiving confirmation of a completed download along with a password, “1601,” to open the archive, thus lowering their suspicion.

The SVG file utilizes double Base64 encoding to conceal JavaScript, which decodes and uses the browser’s Blob function to assemble an archive in memory, saving it as DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z. This process, known as HTML smuggling, allows the malicious download to bypass email security tools, presenting the content as an image file rather than executable code.

Advanced Techniques: DLL Sideloading and Process Hollowing

Upon download, the archive contains a decoy program and several DLL files, masquerading as Brotli compression components. The primary executable uses these DLLs to exploit Windows’ DLL search path, leading to the execution of attacker-supplied libraries.

This DLL sideloading technique obfuscates malicious activities, connecting them to legitimate applications, complicating early detection. The loader creates persistence by copying files into a user directory and establishing a Windows Registry Run entry, eventually decrypting its payload in memory. This payload launches under the guise of a legitimate Windows component, maintaining remote-control capabilities.

Protection and Prevention

The final payload employs encrypted communications, anti-analysis techniques, and persistent connection attempts to its command-and-control infrastructure. Although the server was inactive during analysis, the malware continued its attempts to reconnect. Organizations are advised to enhance their screening of SVG and HTML attachments, scrutinize unexpected archive downloads, and monitor for unusual DLL loading and process creation.

Security teams should correlate endpoint behavior with network activity, verify file integrity, hunt for suspicious Registry Run entries, and ensure patch hygiene. Crucially, awareness training is vital as the attack’s success depends on users opening the attachment and running the extracted files.