Attackers sent personalized fake federal court notices to more than 100,000 companies, impersonating the US District Court for the Southern District of Florida. The emails directed recipients to a counterfeit court website and offered a password-protected case file that ultimately installed LodaRAT, giving attackers a way to steal credentials, monitor activity, and remotely control Windows computers.
The campaign impersonated the US District Court for the Southern District of Florida, sending personalized emails with a subject beginning "Court-Ordered ADR Notice" to more than 100,000 companies. Each message included the target's details and an ADR case ID, claiming the company was involved in an Alternative Dispute Resolution proceeding. Recipients were directed to a counterfeit portal at florida[.]courtadr[.]com that displayed their own company details and let visitors search for fabricated cases by ADR ID, reinforcing the illusion of a genuine legal matter.
A "Download Your Case File" link on the fake portal delivered a password-protected ZIP archive named after the recipient's ADR reference. Inside was an ISO disk image containing a .msc console file, a .bat batch script, and a .lnk Windows shortcut. These files worked together to download and run LodaRAT using legitimate Windows components, giving attackers a remote access trojan capable of stealing browser credentials and session cookies, logging keystrokes, capturing screenshots, and recording audio and webcam video.
The attack combined personalization with a convincing supporting website rather than relying on the email alone. By showing the target's own company name and a fabricated case ID on the portal, attackers created what amounts to an entire environment in which the alleged legal matter appears to exist. The legal and administrative framing added urgency and legitimacy, since unexpected court correspondence is the kind of message employees often feel compelled to act on quickly.
Organizations should treat unexpected court or legal correspondence as unverified until confirmed through independently obtained contact details rather than information in the message itself. A clear process for forwarding unexpected legal notices to Legal and Security teams helps ensure verification happens before any file is opened. Employees should never need to download an alleged case file to judge whether a notice is genuine. Security teams should also review how email and endpoint controls handle password-protected archives, disk images, scripts, and shortcuts from external sources, and awareness training should reinforce prompt reporting if a suspicious file has already been opened, so response can go beyond simply deleting the download.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a phishing campaign that impersonated the US District Court for the Southern District of Florida, sending personalized fake Alternative Dispute Resolution notices to more than 100,000 companies to deliver LodaRAT malware.
Recipients were directed to a counterfeit court portal and offered a password-protected ZIP archive named after their ADR reference. The archive contained an ISO image with .msc, .bat, and .lnk files that downloaded and ran LodaRAT through legitimate Windows components.
LodaRAT can steal browser credentials and session cookies, log keystrokes, capture screenshots, record audio and webcam video, and remotely control infected Windows devices.
Red flags include the notice arriving from an unverified sender address, pressure to download a password-protected archive, and a supposed case file containing an ISO image or executable-style Windows files rather than ordinary court documents.
A federal court notice names your company. Real case? The sender is Resolution@courtadr.com, not a verified court address. Its link opens florida.courtadr.com, a fake Southern District of Florida portal showing your company details and a searchable ADR ID. Aha: matching details aren't proof. 'Download Your Case File' gives you a password-protected ZIP, then an ISO with .msc, .bat, and .lnk files, not court documents. Those can install LodaRAT. LodaRAT can steal passwords and control your PC. Don't download the file, send the notice to Legal and Security.
EU regulators are investigating Booking.com over phishing, fraudulent listings, and impersonation scams affecting travelers and accommodation partners. The article describes several real campaigns, including fake Booking.com messages that sought payment details from customers and complaint-themed…
Researchers observed a real phishing campaign that abused Microsoft 365’s “Direct Send” feature to deliver messages that looked like they came from trusted internal addresses (HR, accounting, admin). The emails commonly used familiar business lures like invoices, payment approvals, voicemail…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
FortiGuard Labs reports an active phishing operation (“TTF Trap”) where emails posing as invoices, shipping documents, or business proposals deliver an archive that ultimately runs malware on Windows. The trick is a file ending in .ttf (TrueType font) that is actually a malicious script executed by…
Researchers reported an active PhantomEnigma campaign where attackers hijacked 20+ Brazilian government websites and used them as trusted stepping-stones to deliver malware. The lure used official-looking police-themed documents (sometimes with QR codes) and emails that could pass common email…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
