A threat group known as Blind Eagle has resurfaced with a large phishing campaign across Latin America, using fake court and administrative notices to deliver a remote access trojan. Researchers at security firm Zenox observed nearly 3,300 malicious emails in the campaign between late October and early November 2026, and shared their findings with The Hacker News on 10 November. The group, also tracked as APT-C-36, is a Spanish-speaking operation that has been active since 2018.

The campaign matters because of who it targets and how convincing the lures are. The emails are aimed at people who handle legal cases, contracts and institutional requests, and they arrive dressed as the kind of official documents those staff cannot afford to ignore. A single opened attachment can hand attackers remote control of a workstation inside a court, a prosecutor's office or a bank.

Fake court papers as the lure

The lures are written in Spanish and Portuguese and resemble court notifications, notices from a fiscalia or prosecutor's office, tutela proceedings and administrative documents. One email identified by researchers carried a Colombian judicial-themed file that rendered a bogus web page impersonating Colombia's Fiscalia General de la Nacion, the Office of the Attorney General.

The campaign targets judicial, fiscal, administrative and educational organisations, with Colombia a priority target and Brazil also in scope. Researchers say the repeated focus on Colombia reflects uneven security maturity across parts of the country's public, financial and private-sector infrastructure, which makes official-looking legal lures more likely to succeed there.

How the attack works

The attack chain starts with a phishing email carrying a weaponised XHTML file containing a Scalable Vector Graphics image. Opening it renders the fake prosecutor's office page, which uses a technique known as HTML smuggling to assemble the next-stage ZIP archive locally inside the victim's web browser, using ZipCrypto. Because the payload is built on the victim's own machine rather than downloaded as a file, it can slip past email security controls that scan attachments.

The final payload is a remote access trojan that shares lineage with AsyncRAT and DCRat, based on its code structure, configuration and observed behaviour. Once installed, it establishes persistence in the Windows Startup folder, giving the attackers a foothold that survives a reboot. Blind Eagle has a long record of distributing commodity remote access tools, including AsyncRAT, BitRAT, Lime RAT, NjRAT, Quasar RAT and Remcos RAT.

What is, and is not, confirmed

An important caveat applies to this campaign. Zenox told The Hacker News it could not confirm whether any of the attacks had succeeded against real-world targets, and no confirmed compromises have been documented. The scale of the email wave is established, but the number of victims is not.

If an attack does succeed, the impact could be severe. A successful compromise could lead to reconnaissance of the victim's environment, collection of documents, keystroke and screen capture, surveillance and data exfiltration over an encrypted channel. That is a serious risk for organisations holding sensitive legal and financial information.

Staff who receive an unexpected court or legal notice by email should verify it through official channels before opening any attachment, and report it to their security team. Organisations should filter and sandbox attachments with legal-themed lures and watch for new remote access processes on their networks.