Reported by 2 outlets

Timeline

1. original reporting

   Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser

   gbhackers.com · 60d ago · August 14th, 2026

   A newly analyzed DarkCrystal RAT (DCRat) campaign shows how threat actors are turning an apparently harmless SVG attachment into a full malware-delivery mechanism. The operation, investigated by the Trellix Advanced Research Center (ARC) following a customer escalation, uses a Colombian judicial-themed lure and reconstructs a password-protected archive directly inside the victim’s browser before progressing through […] The post Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   DCRat Malware Uses DLL Sideloading and Process Hollowing to Hide Inside Trusted Windows Process

   cyberpress.org · 60d ago · August 14th, 2026

   The attack ultimately hides a remote-access trojan inside a legitimate Windows-related process, helping it blend into normal endpoint activity. The campaign uses a fake legal-notice lure named “Resolución Denuncia Jurídica,” designed to exploit fear and urgency. Victims receive a phishing email with an SVG attachment that appears harmless but contains embedded JavaScript. When opened, the SVG directs users to a fake Colombian judicial portal and creates a password-protected archive named DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z . The JavaScript is double Base64-encoded and reconstructs the archive in the browser using a Blob object. This is a form of HTML smuggling, where malicious content is concealed inside a file type that may pass through email security controls more easily than executable files. DCRat Hides Inside Windows The archive contains a decoy executable, supporting DLL files, and a hidden malware chain. The loader uses names associated with Brotli, a legitimate compression technology, including libbrotlidec.dll and libbrotlienc.dll . These names make the files appear less suspicious to victims and analysts. When the victim launches the decoy executable, Windows searches the local directory for required DLLs. The malware abuses this behavior by placing malicious DLLs next to the executable. Instead of loading legitimate Brotli libraries, the program loads attacker-controlled versions. Phishing email (Source: trellix) This technique, known as DLL sideloading