Blind Eagle is using Spanish- and Portuguese-language phishing emails that look like court, prosecutor, and administrative notices to target organizations in Latin America. The emails pressure people who handle legal or institutional requests to open an attachment, which ultimately installs remote-access malware. Researchers did not confirm successful compromises, but the campaign provides a clear, realistic phishing workflow for awareness training.
Blind Eagle, also tracked as APT-C-36, sent phishing emails in Spanish and Portuguese designed to look like court notifications, fiscalía notices, tutela proceedings, and administrative documents. The messages targeted people who routinely deal with cases, contracts, judicial matters, or institutional service requests, pressuring them to open an attachment tied to an alleged legal or administrative proceeding.
One identified email used a Colombian judicial-themed XHTML file built as a weaponized SVG image. Opening it rendered a bogus web page impersonating Colombia's Fiscalía General de la Nación, the Office of the Attorney General. The page used HTML smuggling to assemble a ZIP archive locally in the victim's browser using ZipCrypto, a method that helps the payload slip past some email security controls because the archive never travels as a single file through the network.
Inside the ZIP was a JavaScript dropper disguised as “Network Configuration Auditor version 2.7.298.” Running it launched a Visual Basic Script that performed AMSI and ETW bypass steps while displaying a fake criminal-citation page as a distraction. The chain ultimately used PowerShell to decode and launch a remote-access trojan in memory.
The lure worked because it exploited the natural urgency people feel around legal and administrative matters. A message claiming to involve a court case, prosecutor's notice, or contract issue creates pressure to act quickly, especially for staff whose job is to respond to exactly these kinds of requests. The fake citation page added a layer of distraction, keeping the recipient's attention on a seemingly real document while the technical infection steps ran in the background.
Organizations handling judicial, fiscal, administrative, or educational matters should treat unsolicited legal notices as high-risk until verified through a known official contact method or portal, never through links or attachments in the message itself. Staff should be trained not to open unexpected XHTML, SVG, ZIP, or script files tied to legal or contract claims, and to report any such attachment that opens a web page or prompts a download or execution. Because this targeting gives attackers access to sensitive legal, financial, and institutional information, extra verification procedures for staff in these roles can meaningfully reduce risk.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a phishing campaign by Blind Eagle, also known as APT-C-36, that uses Spanish and Portuguese emails resembling court, fiscalía, and administrative notices to trick recipients into opening malware-laced attachments.
A weaponized XHTML/SVG file renders a fake page impersonating Colombia's Fiscalía General de la Nación and uses HTML smuggling to assemble a ZIP archive locally in the browser, bypassing some email security controls. Inside the ZIP is a JavaScript dropper disguised as a software update that leads to a remote-access trojan.
The campaign targets people who handle cases, contracts, judicial matters, and institutional service requests, including legal, contract, judicial, and educational administration staff, mainly in Latin American organizations.
Researchers reported no evidence of successful real-world compromises at the time of reporting, though the techniques used are realistic and effective for training purposes.
A court notice lands in your inbox. But it’s an SVG attachment? Blind Eagle’s Spanish- and Portuguese-language emails impersonate Colombia’s Fiscalía General de la Nación. Open the attachment, and a fake prosecutor page appears while your browser builds a ZIP locally. That’s HTML smuggling: the ZIP is assembled after email scanning. Inside, 'Network Configuration Auditor version 2.7.298' is JavaScript, not a case document. Running it can lead to AsyncRAT. A legal notice shouldn’t install software. Got one? Verify it through the agency’s official portal, not the attachment.
A Sirius backdoor campaign used Korean-language emails that impersonated FedEx billing notices and demanded payment of a fraudulent tax invoice. The email directed recipients to a ZIP file containing a weaponized PDF, which required the recipient to approve a PDF-reader security prompt before it…
Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and transport organizations with spearphishing emails disguised as routine administrative fines and tax notices. The group used compromised government email accounts and weaponized attachments to steal browser passwords,…
China-linked espionage campaigns used compromised websites to show selected visitors a fake Chrome certificate warning and persuade them to install a “Certificate Fix” utility. The same malware was also delivered to Indonesian organizations in phishing emails using a shortcut file disguised as a…
Microsoft observed real Q3 2026 phishing campaigns that used familiar workplace requests to steal credentials or deliver malware. One campaign targeted legal organizations with personalized salary-review documents containing QR codes, while another used purchase-order and payroll lures in disguised…
The article describes active campaigns that use familiar business documents, trusted file-sharing services, AI brands, and Microsoft sign-in flows to trick employees into granting account access. The most actionable patterns are phishing emails and document links that lead victims to Microsoft…
North Korean-linked attackers reportedly used a fake job opportunity, multiple interviews, and a malicious coding assignment to compromise a Binance engineer. The scheme built trust over weeks before asking the employee to download an interview file, giving attackers a foothold in the company’s…
