securityonline.info 8/18/2026, 1:20:57 AM · external

DarkCrystal RAT spreads via fake Colombian justice SVG phishing

DarkCrystal RAT spreads via fake Colombian justice SVG phishing
CyberSIXT Evidence Panel
Primary Source trellix.com

THE page details an active exploit involving the DCRat (DarkCrystal RAT) malware, which utilizes a phishing campaign centered around a manipulated SVG email attachment disguising as a Colombian judicial notice. The attack leverages HTML smuggling, DLL sideloading, and process hollowing techniques to execute remotely controlled payloads. Key points include:

1. **Malware Delivery**: The campaign starts with an SVG email attachment that contains embedded JavaScript.

2. **Infection Chain**: The SVG file decodes Base64 content and delivers a ZIP archive containing malicious DLLs.

3. **Execution Techniques**: The malware runs using DLL sideloading and process hollowing, creating the illusion of normal operations.

4. **Command and Control**: The malware employs SSL connections and attempts to reconnect when the command server is offline.

5. **Defense Recommendations**: Suggestions include tightening security measures for email attachments and monitoring for suspicious process behavior.

View Primary Source Via securityonline.info

Article by CyberSIXT