# Blind Eagle campaign uses fake legal notices to deliver remote access malware

_Published Tuesday, November 10, 2026 at 12:07 PM EST · Security · Latest · Tier 2 — Notable_

![Blind Eagle campaign uses fake legal notices to deliver remote access malware — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhs4UHnKTj_NJCPa7Jqdntj8tEvZ2PgaY7s9kKK8_X2bxehTUcJeZPFfguJzvW_D0H9XD_q-qLZV2Qq6hqRYDQRYMXpyAzw-6T2yDjFjIY7zhGRLPDPjOalASUgX_Z-M2cEsNqiuys_4QjQ8vY_xl0fnWi2Y_9tT9aAH0WQOAB3D6uDf8yZY8VuphL4TRFG/s1700-nu-rw-lo-l85-e365/court-phish.jpg)

Security firm Zenox identified a Blind Eagle campaign targeting Latin American organizations with Portuguese and Spanish legal and administrative notices that deliver remote access malware, The Hacker News reported.

One attack uses an attachment impersonating Colombia's attorney general's office. It assembles a ZIP archive inside the browser to bypass email security controls, then launches scripts that evade Windows security monitoring and establish persistence. PowerShell loads the final malware into memory.

The payload is an AsyncRAT fork with DCRat lineage. A compromise could enable document collection, keystroke capture and data theft, but there is no evidence that the attacks have succeeded against real-world targets.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/blind-eagle-uses-fake-court-notices-to.html)

---
Canonical: https://techandbusiness.org/newswire/NCvf9Z73lkoQekmTKRynrS
Published: 2026-11-10T17:07:17.873Z
Story chronology: 2026-11-10T15:58:00.000Z
Retrieved: 2026-11-10T19:12:38.809Z
Publisher: Tech & Business (techandbusiness.org)