thehackernews.com
Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America
Blind Eagle, a Spanish‑speaking threat actor active since 2018, launched a new phishing campaign targeting Latin American judicial, fiscal, and educational institutions. Emails in Portuguese and Spanish mimic court and administrative notices, delivering a malicious XHTML file that uses HTML smuggling to build a ZIP payload in the browser. The ZIP contains a JavaScript dropper masquerading as a network audit tool, which bypasses AMSI and ETW, establishes persistence, and ultimately deploys an AsyncRAT fork for remote access. [...]