Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser

Gbhackers •Mayura Kathir • August 14, 2026

A newly analyzed DarkCrystal RAT (DCRat) campaign shows how threat actors are turning an apparently harmless SVG attachment into a full malware-delivery mechanism. The operation, investigated by the Trellix Advanced Research Center (ARC) following a customer escalation, uses a Colombian judicial-themed lure and reconstructs a password-protected archive directly inside the victim’s browser before progressing through […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SVG-Based DCRat Campaign Delivers Malware via Phishing Emails A new campaign utilizing DarkCrystal RAT (DCRat) has been identified, where threat actors employ SVG files disguised as legal notifications to deliver malware. The campaign begins with phishing emails urging users to open the SVG attachment, which reconstructs a password-protected archive directly in the browser. This method leverages HTML smuggling techniques to bypass traditional security measures. The Trellix Advanced Research Center investigated the operation after a customer escalation, revealing the sophisticated nature of the attack. Victims are primarily individuals receiving these phishing emails, which appear legitimate and harmless. The campaign highlights the evolving tactics of cybercriminals in malware delivery. Current status indicates that organizations should remain vigilant against such phishing attempts. 5 sources 59

Extracted Entities

Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (2)

MITRE ATT&CK (1)