DcRAT Screen Capture via svchost.exe GDI BitBlt (Operation DragonReturn)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the spawning of svchost.exe processes from parent processes associated with Windows Mixed Reality or NvdaHelperRemote, which may indicate malicious process injection or suspicious use of GDI screen capture APIs within a masqueraded service context.