DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smuggling

Cybersecuritynews •Tushar Subhra Dutta • August 14, 2026

A new DCRat campaign is using a familiar image format to hide a dangerous malware archive. The operation begins with phishing emails that pose as legal notifications and urge recipients to open an attached SVG file. The attachment looks harmless because SVG files are commonly used for graphics. In this case, however, the file contains […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SVG-Based DCRat Campaign Delivers Malware via Phishing Emails A new campaign utilizing DarkCrystal RAT (DCRat) has been identified, where threat actors employ SVG files disguised as legal notifications to deliver malware. The campaign begins with phishing emails urging users to open the SVG attachment, which reconstructs a password-protected archive directly in the browser. This method leverages HTML smuggling techniques to bypass traditional security measures. The Trellix Advanced Research Center investigated the operation after a customer escalation, revealing the sophisticated nature of the attack. Victims are primarily individuals receiving these phishing emails, which appear legitimate and harmless. The campaign highlights the evolving tactics of cybercriminals in malware delivery. Current status indicates that organizations should remain vigilant against such phishing attempts. 5 sources 59

Extracted Entities

DCRat Campaign Hides Malware Archive Inside SVG Using HTML Smuggling

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)