Operation DragonReturn: XenoRAT+DcRAT Double Injection from Mixed Reality.exe into svchost.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects cross-process injection (Process Injection) from a specifically identified 'Mixed Reality' process into svchost.exe, followed by suspicious module loads (non-system32 DLLs) within that svchost.exe instance. This behavior pattern is consistent with DcRAT and XenoRAT deployment activities using masquerading or hijacked processes.