DCRat Malware Hits Windows with Remote Access, Keylogging, Screen Capture, and File Theft Capabilities

**Executive Summary:** A targeted phishing campaign is deploying the modular DCRat RAT against Windows users (predominantly in Colombia) via password-protected ZIPs that execute obfuscated scripts which retrieve a steganography-embedded payload; the malware supports modular plugins, credential harvesting, keylogging, persistence, and remote control. The report includes anti-analysis details (virtual machine checks, AMSI bypass), full attack chain description, and multiple IoCs (paste URLs, image archive, SHA-256 hashes, and a C2 IP), and notes that Fortinet products can detect and block the threat when signatures and engines are current.