Dcrat

DcRAT is a malicious software that has been used in various cyberattacks throughout 2023 and into 2024. The malware, distributed through fake OnlyFans content, deceptive Google Meet sites, and spoofed Skype and Zoom websites, downloads a DcRAT payload when users click on certain elements. This Remote Access Trojan (RAT) allows threat actors to steal confidential information, disrupt operations, or even hold data hostage for ransom. It's part of a broader campaign that includes other threats such as njRAT, DarkComet, AgentTesla, and more. In December 2023, Zscaler’s ThreatLabz uncovered a significant campaign involving the distribution of different RATs to Android and Windows users. These attacks utilized spoofed versions of popular communication platforms like Google Meet, Zoom, and Skype to facilitate the deployment of trojans including NjRAT, DCRat, and SpyNote RAT. The latter was specifically targeted at Android devices, while NjRAT and DCRat were deployed on Windows systems. The threat actors behind these campaigns use a variety of tactics to trick users into downloading their malware payloads. For instance, they provide links to download fake Skype applications that, in reality, are trojans like the SpyNote RAT or DCRat. They also use misleading domain names to entice unsuspecting users to join meetings where they become targets for these attacks. These RATs can log keystrokes, steal files, and compromise sensitive data, making them a significant threat to both individual and network security.