Atlas RAT Webcam Surveillance: avicap32.dll Load by Non-Media Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the loading of the 'avicap32.dll' (Video Capture API) module by processes that are not recognized as legitimate media, conferencing, or streaming applications. This behavior is often associated with remote access tools (RATs) like Atlas RAT, which may use this library to covertly capture video from a webcam.