Signed, Sealed, Injected: The Mechanics of DCRat in 2026
Trellix, Thursday, August 13th, 2026
Trellix analyses a DCRat campaign using SVG-based HTML smuggling, DLL sideloading and process hollowing.
The Trellix Advanced Research Center analysed an active DarkCrystal RAT campaign identified in early 2026 following a critical customer escalation. The operation used a judicial-themed phishing lure masquerading as an official legal complaint resolution to pressure victims into opening the attachment.
Initial access came via a phishing email carrying an SVG attachment with embedded JavaScript, a form of HTML smuggling since SVGs are XML-based image files capable of executing JavaScript, which dropped a ZIP archive containing an executable and multiple DLLs. Every stage required human interaction, and the malicious components executed alongside trusted libraries via DLL sideloading.