Blind Eagle Phishing: Fake Court Notices Spread Malware

Blind Eagle phishing is targeting organizations across Latin America with fraudulent court notifications, judicial documents, and administrative notices designed to trick employees into opening malicious files. The campaign demonstrates why security awareness training and realistic phishing simulations are essential for organizations whose employees regularly handle sensitive documents, legal requests, or institutional communications.

Researchers from Zenox identified a multi-stage malware delivery chain using convincing Spanish and Portuguese messages. Their investigation, published in November 2026, connects the operation to Blind Eagle, also known as APT-C-36.

Although researchers have not confirmed successful compromises of real-world victims, the campaign illustrates how a seemingly legitimate legal notification can lead to remote access malware capable of surveillance and information theft.

What Is the Blind Eagle Phishing Campaign?

Blind Eagle is a threat actor associated with cyberespionage and financially motivated attacks against organizations in Latin America.

Active since at least 2018, the group has repeatedly used spear-phishing emails to deliver remote access trojans, including AsyncRAT, Remcos, Quasar RAT, and related malware families.

The recently investigated campaign targets individuals responsible for legal cases, contracts, administrative procedures, and institutional communications.

According to Zenox, the attackers impersonate judicial and government-related organizations using documents that resemble:

• Court summons and legal notifications.
• Colombian Fiscalía communications.
• Administrative proceedings and official circulars.
• Legal complaints and case-related documents.
• Institutional service requests.

These messages exploit the recipient’s sense of responsibility and the perceived authority of government institutions.

The central objective is to persuade someone to interact with a malicious attachment that initiates a sequence of malware-delivery stages.

How Blind Eagle Phishing Uses Fake Court Notices

The attack relies on a combination of social engineering and technical deception.

Rather than sending an obviously suspicious executable, attackers disguise the initial payload as an official document.

Step 1: A convincing judicial email

The victim receives a message appearing to contain an urgent legal or administrative notification.

The subject and attachment suggest that the recipient must review an official proceeding.

For employees handling contracts or compliance matters, ignoring such a message may appear risky.

This perceived urgency encourages immediate action without independent verification.

Step 2: A fraudulent institutional webpage

One observed attachment used an XHTML filename while containing SVG-based content.

When opened, it displayed a fraudulent webpage impersonating Colombia’s Fiscalía General de la Nación.

The page attempted to reproduce the appearance of an official judicial service.

Its purpose was to convince the recipient that downloading or opening an additional document was a legitimate part of the process.

Step 3: Malware delivery through HTML smuggling

The fraudulent webpage used HTML smuggling to construct a ZIP archive inside the victim’s browser.

This technique can complicate conventional email filtering because the final archive is assembled after the initial attachment reaches the recipient.

Inside the archive, researchers identified a JavaScript dropper disguised as a network configuration auditing utility.

Step 4: Script execution and remote access malware

After execution, the malware collected system information and launched additional components.

Researchers observed attempts to interfere with Windows security monitoring, establish persistence, and load the final payload through PowerShell.

The resulting remote access trojan shared characteristics with AsyncRAT and DCRat.

Its observed capabilities included keylogging, screen capture, remote control, and potential data collection.

These capabilities were analyzed in controlled laboratory environments, not confirmed on compromised production systems.

Why Fake Legal Notices Are Effective Social Engineering

The effectiveness of Blind Eagle phishing does not depend solely on sophisticated malware.

The attackers exploit ordinary workplace expectations.

Legal departments receive unfamiliar case documents. Finance professionals handle official payment requests. Administrative employees process correspondence from external institutions.

A message claiming to come from a government authority may therefore seem relevant to the recipient’s responsibilities.

Three psychological factors make these attacks particularly persuasive.

Authority: The sender appears to represent a judicial or administrative institution.

Urgency: The message implies that delaying a response could have legal or procedural consequences.

Familiarity: The document uses local terminology, regional languages, and recognizable institutional references.

An employee may overlook technical warning signs when the message appears aligned with daily responsibilities.

This is why security awareness programs should emphasize verification habits rather than relying exclusively on lists of suspicious keywords.

How to Recognize Blind Eagle Phishing Emails

Employees do not need to understand HTML smuggling or PowerShell to identify a potentially dangerous legal notification.

They need to recognize situations where independent verification is necessary.

Common warning signs include:

• Unexpected judicial notices received without previous communication.
• Attachments with unusual extensions such as .xhtml, .html, or .svg.
• Documents instructing employees to download additional archives.
• Password-protected ZIP files accompanying unverified legal requests.
• Websites requesting execution of scripts or unfamiliar applications.
• Email addresses or domains inconsistent with the claimed institution.
• Artificial urgency intended to discourage verification.

Importantly, none of these indicators independently proves malicious intent.

Legitimate organizations sometimes send unfamiliar attachments or time-sensitive messages.

The safer approach is to verify the communication using a trusted contact number, official portal, or previously established communication channel.

Employees should never rely solely on contact details supplied within the suspicious message.

Cyberfrog platform

Train people for the attacks they actually face.

Build stronger habits with phishing, vishing, smishing, deepfake and immersive 3D simulations employees remember.

Book a demoSee the attacks

Why Security Awareness Training Must Reflect Real Attacks

Traditional security awareness programs sometimes emphasize generic phishing examples that employees rarely encounter.

A realistic Blind Eagle phishing scenario is different.

It reflects a believable workplace situation involving official documents, unfamiliar senders, and potentially serious consequences.

Organizations can adapt these scenarios into authorized training exercises.

For example, an employee responsible for contracts might receive a simulated judicial notification containing a harmless attachment.

The exercise could assess whether the employee verifies the sender, questions the unexpected document, and reports the message through the approved channel.

Cyberfrog provides phishing and social engineering simulation capabilities designed to help organizations practice responding to realistic threats.

Security teams should also examine external exposure risks. For example, dark web monitoring can complement awareness programs by helping investigate credentials or information exposed outside corporate systems.

Neither approach replaces endpoint security, email protection, or incident response.

Turning Blind Eagle Threat Intelligence Into Practical Training

Security teams can use recent threat intelligence to make employee education more relevant.

The value comes from translating technical findings into decisions employees can understand.

A practical training scenario based on this campaign could include:

1. Recognizing authority impersonation: Identify when a message claims to originate from a court or government agency.
2. Checking unexpected attachments: Examine file types and requests to download additional documents.
3. Verifying through independent channels: Contact the institution using established information.
4. Reporting suspicious communication: Forward the message through the organization’s approved security-reporting process.
5. Reinforcing correct decisions: Explain why verification matters, including when a message looks convincing.

Cyberfrog’s threat-news simulation capabilities are designed to help organizations transform current attack patterns into relevant phishing exercises.

Its approach connects real-world threats with employee learning instead of treating security awareness as an isolated annual activity.

Organizations can also use lessons from related campaigns, such as Cyberfrog’s analysis of the Casbaneiro banking Trojan phishing campaign, which similarly involved fraudulent legal and financial communications targeting Latin America.

What Organizations Should Do to Reduce Phishing Risk

The Blind Eagle campaign demonstrates why human awareness and technical defenses must operate together.

Security teams should prioritize several measures.

Strengthen email and endpoint protection

Configure email gateways to inspect suspicious attachments and unusual file formats.

Use endpoint detection and response tools capable of identifying malicious scripts, suspicious process relationships, and attempts to disable security monitoring.

Train employees to verify authority

Encourage staff to confirm unexpected legal notifications through independent channels.

Provide clear reporting procedures so employees can raise concerns without interrupting essential business processes unnecessarily.

Run realistic phishing simulations

Adapt training scenarios to employees’ responsibilities, languages, and exposure to external correspondence.

Measure reporting behavior, verification decisions, and improvement over time rather than relying exclusively on click rates.

Coordinate HR, IT, and security teams

Effective awareness programs require collaboration.

HR and learning teams can help deliver appropriate training, while security teams supply threat intelligence and technical guidance.

The objective is to reinforce practical habits that employees can apply during routine work.

Frequently Asked Questions

What is Blind Eagle phishing?

Blind Eagle phishing refers to social engineering campaigns attributed to Blind Eagle, also known as APT-C-36.

The group frequently uses targeted emails that impersonate legitimate institutions or organizations to persuade recipients to open malicious files.

Its campaigns have primarily targeted Latin American organizations and have delivered several remote access malware families.

How do fake court notice phishing attacks work?

Attackers send fraudulent judicial or administrative communications designed to appear official.

The recipient may be directed to open an attachment, visit a convincing institutional webpage, or download an additional file.

In the investigated campaign, malicious web content generated an archive that could eventually deliver a remote access trojan.

Has the latest Blind Eagle campaign successfully infected organizations?

Zenox documented the attack infrastructure, malicious attachments, and malware execution chain.

However, researchers stated that they could not confirm successful compromises of real-world targets.

The demonstrated malware capabilities therefore represent potential consequences rather than verified outcomes for specific victims.

Can phishing simulations help prevent malware infections?

Phishing simulations can help employees practice recognizing suspicious messages, verifying requests, and reporting potential attacks.

They cannot guarantee that every malicious email will be detected.

The strongest defense combines repeated awareness training with email filtering, endpoint protection, application controls, and incident-response procedures.

Prepare Employees for the Next Phishing Attempt

Blind Eagle shows how attackers transform familiar workplace communications into opportunities for malware delivery.

Organizations can reduce human cyber risk by helping employees recognize authority impersonation, question unexpected attachments, and verify suspicious requests before acting.

Cyberfrog connects security awareness education with realistic simulations inspired by emerging threats, helping teams build practical detection and reporting habits.

Explore Cyberfrog’s training capabilities or book a Cyberfrog demo to discover how your organization can strengthen employee readiness against phishing and social engineering.