Remcos RAT Covert Audio/Video Surveillance via avicap32.dll Load from AppData/Temp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the loading of avicap32.dll by non-conferencing processes executing from user-writable directories such as AppData or Temp. This behavior is indicative of Remcos RAT or similar remote access trojans attempting to covertly capture audio or video using Windows API modules commonly used for media capture.