Wednesday, January 29, 2025
HomeCyber Security NewsDCRAt Attacking Users Via HTML Smuggling To Steal Login Credentials

DCRAt Attacking Users Via HTML Smuggling To Steal Login Credentials

Published on

SIEM as a Service

Follow Us on Google News

In a new campaign that is aimed at users who speak Russian, the modular remote access tool (RAT) known as DCRat has been utilized. 

Delivered through HTML smuggling, a technique not previously seen with DCRat, the malware leverages its typical RAT capabilities to execute shell commands, log keystrokes, exfiltrate files, and steal credentials, which marks a new delivery method for DCRat, expanding its threat landscape.

HTML smuggling involves embedding obfuscated malicious payloads within HTML code, often retrieved from remote sources, which are designed to bypass security measures and execute in the victim’s browser. 

Leveraging AI for enhanced security => Free Webinar

Once rendered, the payloads are transformed into their original form and written to disk, potentially requiring user interaction, which has been exploited by various malware families, including Azorult, Pikabot, and DCRat, to deliver malicious code to unsuspecting users.

DCRat execution flow

The threat actor utilized fake HTML pages mimicking TrueConf and VK Messenger to trick victims into downloading password-protected ZIP archives. 

These HTML pages, when accessed in popular browsers, automatically initiated the download and provided the decryption password “2024”, which allowed the threat actor to bypass detection by security tools unable to examine the encrypted payload. 

The malicious code within the HTML files was identified as originating from the open-source GitHub repository “TheCyb3rAlpha/BobTheSmuggler”, indicating its potential for further exploitation.

executed the embedded payload

Attackers used a multi-layered archive approach to deliver DCRat.

The initial password-protected ZIP contained a disguised RarSFX archive, which then held a batch file and another password-protected RarSFX with the actual DCRat payload. 

The batch file executed the inner archive, providing the password to extract and run DCRat, whose executables were packed with tools like ENIGMA and VMProtect, and their compilation date suggests the attacker reused older DCRat builds. 

ENIGMA and VMProtect

Threat actors employed a multi-layered obfuscation technique to bypass detection mechanisms by initially nested a password-protected RarSFX archive within another RarSFX archive, eliminating the need for user interaction. 

Subsequently, they wrapped the outermost RarSFX archive in a password-protected ZIP file, forcing users to provide a password.

While this added a layer of complexity, the password-protected ZIP file evaded detection on VirusTotal, demonstrating the effectiveness of such techniques in evading security measures.

The novel use of HTML smuggling to deliver DCRat malware, as researchers observed this tactic for the first time, emphasizing the ongoing need to monitor DCRat’s evolving techniques. 

To mitigate such threats, Netskope recommends organizations thoroughly inspect all HTTP and HTTPS traffic, utilizing URL filtering and threat protection policies.

Additionally, employing Remote Browser Isolation (RBI) technology can provide extra security when accessing potentially risky websites.

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Webinar

Varshini
Varshini
Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Latest articles

Vulnerability in Airline Integration Service enables A Hacker to Gain Entry To User Accounts

A recent security vulnerability in a widely used airline integration service has exposed millions...

Hackers Seize Control of 3,000 Companies Through Critical Vulnerabilities

In a groundbreaking cybersecurity investigation, researchers identified several critical vulnerabilities in a target system,...

PoC Exploit Released for Critical Cacti Vulnerability Let Attackers Code Remotely

A critical vulnerability in the Cacti performance monitoring framework tracked as CVE-2025-22604, has been...

TorNet Backdoor Exploits Windows Scheduled Tasks to Deploy Malware

Cisco Talos researchers have identified an ongoing cyber campaign, active since mid-2024, deploying a...

API Security Webinar

Free Webinar - DevSecOps Hacks

By embedding security into your CI/CD workflows, you can shift left, streamline your DevSecOps processes, and release secure applications faster—all while saving time and resources.

In this webinar, join Phani Deepak Akella ( VP of Marketing ) and Karthik Krishnamoorthy (CTO), Indusface as they explores best practices for integrating application security into your CI/CD workflows using tools like Jenkins and Jira.

Discussion points

Automate security scans as part of the CI/CD pipeline.
Get real-time, actionable insights into vulnerabilities.
Prioritize and track fixes directly in Jira, enhancing collaboration.
Reduce risks and costs by addressing vulnerabilities pre-production.

More like this

Vulnerability in Airline Integration Service enables A Hacker to Gain Entry To User Accounts

A recent security vulnerability in a widely used airline integration service has exposed millions...

Hackers Seize Control of 3,000 Companies Through Critical Vulnerabilities

In a groundbreaking cybersecurity investigation, researchers identified several critical vulnerabilities in a target system,...

PoC Exploit Released for Critical Cacti Vulnerability Let Attackers Code Remotely

A critical vulnerability in the Cacti performance monitoring framework tracked as CVE-2025-22604, has been...