thehackernews.com
Nov 10, 2026
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
AI-summarised brief · reviewed before publication
Blind Eagle, a Spanish‑speaking threat actor active since 2018, launched a new phishing campaign targeting Latin American judicial, fiscal, and educational institutions. Emails in Portuguese and Spanish mimic court and administrative notices, delivering a malicious XHTML file that uses HTML smuggling to build a ZIP payload in the browser. The ZIP contains a JavaScript dropper masquerading as a network audit tool, which bypasses AMSI and ETW, establishes persistence, and ultimately deploys an AsyncRAT fork for remote access. No confirmed real‑world compromises yet, but the campaign could expose sensitive legal and financial data.
💡 Why It Matters
- · The attack’s focus on judicial and fiscal bodies means potential breaches of highly confidential legal and financial records, posing a direct threat to national security and public trust.
