TA4922 Atlas RAT Webcam Capture via avicap32.dll by Non-Media Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects unauthorized webcam usage by monitoring for the loading of avicap32.dll by non-standard processes. This behavior is indicative of the Atlas RAT, which leverages the avicap32 library to perform illicit video surveillance on compromised hosts.