CornFlake RAT (svchost32.exe) Correlated Surveillance: Cam, Mic, Screenshot, Media

Duo Tech@duotech

•updated Aug 6, 2026•2•0•5

Detects a masquerading svchost32.exe process exhibiting two or more correlated surveillance capabilities (webcam, microphone, screenshot/JPEG, WAV audio, removable media access), consistent with CornFlake RAT surveillance.