Blind Eagle campaign uses fake legal notices to deliver remote access malware

Security firm Zenox identified a Blind Eagle campaign targeting Latin American organizations with Portuguese and Spanish legal and administrative notices that deliver remote access malware, The Hacker News reported. One attack uses an attachment impersonating Colombia's attorney general's office. It assembles a ZIP archive inside the browser to bypass email security controls, then launches scripts that evade Windows security monitoring and establish persistence. PowerShell loads the final malware into memory. The payload is an AsyncRAT fork with DCRat lineage. A compromise could enable document collection, keystroke capture and data theft, but there is no evidence that the attacks have succeeded against real-world targets.