{
  "id": 3757924,
  "title": "Dark Caracal's New Malware GoCaracal: From SVG Phishing to Ethereum Backup C2",
  "url": "https://urgent.news/2026/08/27/dark-caracals-new-malware-gocaracal-from-svg-phishing-to-ethereum",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T14:34:32.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/dark-caracals-new-malware-gocaracal-from-svg-phishing-to-ethereum-backup-c2-3cbd"
  },
  "original_language": "en",
  "account": "The Dark Caracal cybercrime group has released a new malware dubbed GoCaracal, part of their ongoing phishing campaign targeting Spanish-language financial and tax themes. Emails, which have not been recovered, contained malicious SVG attachments. Once opened, the SVGs redirected victims to attacker-controlled sites using Base64-encoded URLs and URL shorteners. These sites delivered a lightweight GoCaracal executable within a 7-Zip archive. Upon execution, GoCaracal collected host information, registered with a custom encrypted C2 protocol, and provided the user with remote shell access, file downloads, and execution capabilities. An extended 34-feature build, activated if the primary C2 fails, further enabled the malware by stealing browser cookies, login databases, conducting keylogging, and searching for files. In a novel approach, the malware can also communicate with Ethereum smart contracts via JSON-RPC to obtain alternative C2 addresses. This GoCaracal malware, along with supporting tools Bandook and AsioGate, poses a significant threat to Windows systems, particularly for organizations handling sensitive financial and tax data.",
  "summary": "1. Basic Information Article Title : Dark Caracal Reloaded: New Malware, Same Hunting Grounds Publisher : Arctic Wolf Labs Publication Date : 2026-08-26 Source : Arctic Wolf Labs Related Sources : Dark Reading , Kaspersky Dark Caracal campaign report Related Malware, Threat Groups, CVEs, Products : GoCaracal, Bandook, AsioGate, Dark Caracal, Microsoft Windows, Ethereum JSON-RPC Severity : High 2.…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}