FlagThis — Daily Cybersecurity Intelligence Briefing

Threat actors are deploying a DCRat (Remote Access Trojan) campaign utilizing social engineering and HTML smuggling to bypass traditional perimeter defenses. The attack vector involves phishing emails containing malicious SVG (Scalable Vector Graphics) files, often disguised as legal notifications. Upon being opened in a web browser, the SVG leverages JavaScript-based Blob objects to reconstruct a compressed malware archive locally on the endpoint. This client-side reconstruction allows the payload to evade network-based inspection and secure email gateways. Once deployed, the DCRat payload may utilize memory injection techniques to establish persistence, granting attackers unauthorized remote control and data exfiltration capabilities.