TA4922 Atlas RAT Webcam Capture via avicap32.dll by Non-Media Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the loading of the avicap32.dll library (a legacy Windows Multimedia API used for webcam capture) by processes other than recognized media or conferencing applications. This is a common indicator of RATs (such as Atlas RAT or Gh0stRAT) attempting to clandestinely record video or audio from the victim's device.