More than 100,000 companies have been targeted by a phishing campaign impersonating a United States federal court, researchers at ThreatDown have reported. The emails pretend to come from the United States District Court for the Southern District of Florida and refer to an Alternative Dispute Resolution case involving the recipient's company. Each message carries a unique case identifier, formatted to look like a genuine civil case number, and a link to a fake court portal.

How the trap works

The portal is personalised with the target company's name, contact address and case identifier, and it only displays its content to visitors using Microsoft Edge, a trick designed to dodge automated security checks. Visitors are invited to download a password-protected ZIP file presented as their case file. Inside is a disk image containing three files, and opening any of them installs the same remote-access malware, LodaRAT, disguised under familiar Windows-style names.

What the malware can do

Once installed, LodaRAT can steal saved browser passwords, log keystrokes, capture screens, record audio and video, and take Wi-Fi passwords, according to the researchers. It also sets up several ways to survive a reboot, including registry entries, startup shortcuts, scheduled tasks and a watchdog script that restarts it if it is stopped. The real court is aware of the campaign and has issued an official warning, researchers say.

The campaign is a warning against trusting legal-looking messages at face value. A genuine court will not ask a company to download a case file from an unfamiliar portal, and unexpected attachments should never be opened on the strength of an official-looking logo alone. Staff who receive such a message should report it to their IT team and verify any claimed case directly through the court's official channels.

Sources: ThreatDown and HackRead.