A stealthy phishing campaign known as PHALT#BLYX leveraged fake CAPTCHAs and BSOD screens to deploy DCRat, with forensic analysis uncovering widespread DNS misuse, typosquatting, and more than 21,000 email-connected domains.