In a new campaign that is aimed at users who speak Russian, the modular remote access tool (RAT) known as DCRat has been utilized.  Delivered through HTML smuggling, a technique not previously seen with DCRat, the malware leverages its typical RAT capabilities to execute shell commands, log keystrokes, exfiltrate files, and steal credentials, which marks a new delivery method for DCRat, expanding its threat landscape. HTML smuggling involves embedding obfuscated malicious payloads within HTML code, often retrieved from remote sources, which are designed to bypass security measures and execute in the victim’s browser.  Leveraging AI for enhanced security => Free Webinar Once rendered, the payloads are transformed into their original form and written to disk, potentially requiring user interaction, which has been exploited by various malware families, including Azorult, Pikabot, and DCRat, to deliver malicious code to unsuspecting users.

Source: GBHackers