Fake Court Notices Push LodaRAT to Businesses

A phishing campaign impersonated a U.S. federal court and targeted more than 100,000 businesses with fake Alternative Dispute Resolution notices. Victims who followed the link reached a personalized fake court portal and were urged to download an archive that installed remote-access malware capable of stealing credentials and monitoring victims.

Key findings

• Attackers impersonated the U.S. District Court for the Southern District of Florida in fake Alternative Dispute Resolution notices.
• The campaign targeted more than 100,000 businesses and used unique civil case identifiers to make notices appear credible.
• Links opened fraudulent court portals personalized with the target company’s details.
• The site only served content to Microsoft Edge visitors, an evasion tactic intended to avoid security scanners.
• Victims were prompted to download a password-protected archive containing an ISO file with multiple launch options.
• The downloaded LodaRAT malware can log keystrokes, steal browser credentials and Wi-Fi passwords, record audio and video, enable RDP, and spread through local networks.

Who’s being targeted

• Commonly targeted roles: Legal, Executive leadership, Finance, Office administration, IT, All employees who handle external notices.
• Affected industries: Businesses across industries.
• Attack channels: website.
• Impersonated: U.S. District Court for the Southern District of Florida.

Awareness takeaways

• Treat unexpected legal notices, especially those demanding a download, as suspicious until verified through independently sourced court contact details or a known legal representative.
• Do not open password-protected archives or ISO files received through unsolicited notices; escalate them to the security team instead.
• Personalized company information is not proof that a request is legitimate; attackers can use it to make fake portals and notices look convincing.

Red flags to watch for

• An unexpected legal notice asks the recipient to download an archive rather than use a known court channel.
• The site tailors details to the recipient company to create false legitimacy.
• The download is a password-protected archive containing an ISO file rather than a standard court document.