Wednesday, May 7, 2025
HomeCyber Security NewsDCRAt Attacking Users Via HTML Smuggling To Steal Login Credentials

DCRAt Attacking Users Via HTML Smuggling To Steal Login Credentials

Published on

SIEM as a Service

Follow Us on Google News

In a new campaign that is aimed at users who speak Russian, the modular remote access tool (RAT) known as DCRat has been utilized. 

Delivered through HTML smuggling, a technique not previously seen with DCRat, the malware leverages its typical RAT capabilities to execute shell commands, log keystrokes, exfiltrate files, and steal credentials, which marks a new delivery method for DCRat, expanding its threat landscape.

HTML smuggling involves embedding obfuscated malicious payloads within HTML code, often retrieved from remote sources, which are designed to bypass security measures and execute in the victim’s browser. 

- Advertisement - Google News

Leveraging AI for enhanced security => Free Webinar

Once rendered, the payloads are transformed into their original form and written to disk, potentially requiring user interaction, which has been exploited by various malware families, including Azorult, Pikabot, and DCRat, to deliver malicious code to unsuspecting users.

DCRat execution flow

The threat actor utilized fake HTML pages mimicking TrueConf and VK Messenger to trick victims into downloading password-protected ZIP archives. 

These HTML pages, when accessed in popular browsers, automatically initiated the download and provided the decryption password “2024”, which allowed the threat actor to bypass detection by security tools unable to examine the encrypted payload. 

The malicious code within the HTML files was identified as originating from the open-source GitHub repository “TheCyb3rAlpha/BobTheSmuggler”, indicating its potential for further exploitation.

executed the embedded payload

Attackers used a multi-layered archive approach to deliver DCRat.

The initial password-protected ZIP contained a disguised RarSFX archive, which then held a batch file and another password-protected RarSFX with the actual DCRat payload. 

The batch file executed the inner archive, providing the password to extract and run DCRat, whose executables were packed with tools like ENIGMA and VMProtect, and their compilation date suggests the attacker reused older DCRat builds. 

ENIGMA and VMProtect

Threat actors employed a multi-layered obfuscation technique to bypass detection mechanisms by initially nested a password-protected RarSFX archive within another RarSFX archive, eliminating the need for user interaction. 

Subsequently, they wrapped the outermost RarSFX archive in a password-protected ZIP file, forcing users to provide a password.

While this added a layer of complexity, the password-protected ZIP file evaded detection on VirusTotal, demonstrating the effectiveness of such techniques in evading security measures.

The novel use of HTML smuggling to deliver DCRat malware, as researchers observed this tactic for the first time, emphasizing the ongoing need to monitor DCRat’s evolving techniques. 

To mitigate such threats, Netskope recommends organizations thoroughly inspect all HTTP and HTTPS traffic, utilizing URL filtering and threat protection policies.

Additionally, employing Remote Browser Isolation (RBI) technology can provide extra security when accessing potentially risky websites.

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Webinar

Varshini
Varshini
Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Latest articles

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...

Healthcare Sector Becomes a Major Target for Cyber Attacks in 2025

The healthcare sector has emerged as a prime target for cyber attackers, driven by...

SysAid ITSM Vulnerabilities Enables Pre-Auth Remote Command Execution

Security researchers have disclosed a chain of critical vulnerabilities affecting SysAid ITSM’s On-Premise solution,...

CISA Warns of Cyber Threats to Oil and Gas SCADA and ICS Networks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a new alert warning critical...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

PoC Tool Released to Detect Servers Affected by Critical Apache Parquet Vulnerability

F5 Labs has released a new proof-of-concept (PoC) tool designed to help organizations detect...

Healthcare Sector Becomes a Major Target for Cyber Attacks in 2025

The healthcare sector has emerged as a prime target for cyber attackers, driven by...

SysAid ITSM Vulnerabilities Enables Pre-Auth Remote Command Execution

Security researchers have disclosed a chain of critical vulnerabilities affecting SysAid ITSM’s On-Premise solution,...