Remcos RAT Audio and Webcam Capture via avicap32.dll and MicRecords

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the loading of the avicap32.dll library (often used for webcam/audio capture) by unexpected processes, or any file access activity within the 'C:\MicRecords\' directory, which may indicate unauthorized surveillance or credential/audio harvesting.