DCRat Malware Uses DLL Sideloading and Process Hollowing to Hide Inside Trusted Windows Process
Brief
The attack ultimately hides a remote-access trojan inside a legitimate Windows-related process, helping it blend into normal endpoint activity.
The campaign uses a fake legal-notice lure named “Resolución Denuncia Jurídica,” designed to exploit fear and urgency. Victims receive a phishing email with an SVG attachment that appears harmless but contains embedded JavaScript.
When opened, the SVG directs users to a fake Colombian judicial portal and creates a password-protected archive named DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z .
The JavaScript is double Base64-encoded and reconstructs the archive in the browser using a Blob object.
This is a form of HTML smuggling, where malicious content is concealed inside a file type that may pass through email security controls more easily than executable files.