Blind Eagle is emailing fake court notices across Latin America to plant remote-access malware

A long-running hacking group known as Blind Eagle, also tracked as APT-C-36, is behind a new wave of emails made to look like court and prosecutor notices, according to the Brazilian security firm Zenox. The emails, in Spanish and Portuguese, carry an attachment that ends with a remote access trojan (RAT) on the victim’s Windows computer: malware that lets the attacker control the machine and steal from it.

Zenox told The Hacker News it saw nearly 3,300 malicious emails in the wave between late October and early November 2026. It said it couldn’t confirm whether any attacks had succeeded against real targets.

Who is being targeted

The lures imitate court notifications, notices from Colombia’s Fiscalía General de la Nación (the Attorney General’s Office), tutela proceedings (a Colombian legal action to protect fundamental rights) and other administrative documents. Zenox says the emails go to people who handle cases, contracts and judicial or institutional requests at judicial, tax, administrative and educational organizations. Colombia remains the main target, but not every message was aimed there.

Blind Eagle, which The Hacker News describes as a Spanish-speaking group active since 2018, has a history of using targeted phishing emails to install off-the-shelf remote-access tools.

How the attack works

Zenox rebuilt the full chain in a lab:

1. The email claims a decision has been issued and attaches a file named like a court document. It ends in .xhtml but is really an SVG image that opens in the browser as a fake Fiscalía records page.
2. That page builds a ZIP file inside the browser, a trick called HTML smuggling that helps it slip past email filters.
3. The ZIP holds a script posing as a “Network Configuration Auditor”. When run, it collects details about the computer and launches more scripts that switch off Windows security checks, show a fake “criminal citation” page as a distraction, delete the original attachment and set themselves to run at startup.
4. Finally, PowerShell loads the RAT straight into memory. Zenox says it’s a fork of the well-known AsyncRAT with code from DCRat.

Zenox links the campaign to a Brazilian operating cluster, based on Brazilian hosting, Portuguese code and lures, and a São Paulo time zone in the attackers’ setup.

What you can do

1. Courts and prosecutors don’t serve notices through surprise email attachments. If an email says you’re part of a case, look up the court or office yourself and contact it, or check its official portal.
2. Be suspicious of “document” attachments that open in your browser or end in .xhtml, .svg, .html, .js or .vbs. A legal notice should not need any of those.
3. Don’t open ZIP files from unexpected legal or tax emails, and never run a script inside one.
4. If you opened one, disconnect the computer from the network and tell your IT team. From another device, change passwords you use on that computer, starting with email and banking.

How Frame helps

This campaign installs malware on computers. It isn’t a data breach at a company, so there isn’t a breach to add. Frame can look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan devices for malware.

Related coverage

• How infostealers steal your sessions, and why a new password isn’t enough: what malware like this can take from a computer once it’s running.
• A revised tax notice that is not in your CRA account is a scam: the same trick of borrowing a government body’s authority, here in Canada.

Sources

• Zenox, LAST HEIST: New APT-C-36 infection wave in LATAM, November 2026
• The Hacker News, Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America, November 10, 2026