Blind Eagle: A Fake Court Notice That Builds Its Own ZIP in the Browser

Blind Eagle's fake court notice is an SVG attachment that builds its own ZIP inside the victim's browser, so an email gateway never sees an archive to scan.

HTML smuggling is a technique in which a web page or file builds the malicious payload on the victim's own device, using code that runs in the browser, instead of delivering the finished file inside the email or from a download link.

ZenoX published the analysis on 4 November 2026 and The Hacker News reported it on 10 November. The actor is Blind Eagle, also tracked as APT-C-36, which MITRE describes as a suspected South American group active since at least 2018. ZenoX rebuilt this wave from 12 initial emails, and The Hacker News reported that ZenoX counted nearly 3,300 malicious emails in the wider wave between late October and early November.

How does Blind Eagle's HTML smuggling attack work?

ZenoX's reconstruction runs in six steps. The filenames and stage details below are ZenoX's; the order is simplified.

1. A Portuguese or Spanish email with a judicial or administrative theme arrives with an attachment ending in .xhtml. ZenoX saw court notifications, fiscalía notices and a tutela proceeding as themes.
2. The attachment is really an SVG. Opened in a browser, it draws a "Consultas" page styled as the Fiscalía General de la Nación, with a case-number field, then a second page that reports a completed download and shows an access key.
3. The page builds a ZIP in the browser with ZipCrypto and displays the password. ZenoX gives the filename pattern as Demanda_Ejecutiva_*__EXP2026-XXXX.zip.
4. Opening the ZIP runs a JavaScript dropper named Network Configuration Auditor v2.7.298, which profiles the host and chains the later stages.
5. A VBScript stage bypasses AMSI and ETW and shows a decoy "CITACION PENAL, FISCALIA" page. Around the same stage the script deletes the original XHTML, strips Mark-of-the-Web through Zone.Identifier and leaves a Startup-folder shortcut.
6. PowerShell decodes the final payload (AES-256-ECB, a custom Base85, then GZIP) and loads it in memory through Reflection, with no final payload file persisted to disk.

What the final payload can do

ZenoX classifies the payload as an AsyncRAT fork with DCRat lineage, a 64-bit .NET DLL, with high confidence for the technical lineage. In the lab it opened a hidden desktop, logged keystrokes, captured the screen, impersonated tokens, blocked keyboard and mouse input and sent judicial and tax documents out over an encrypted channel. The command server it points to is listed under reported indicators.

How do attachments like this evade traditional email security filters?

Email filters judge what they are handed. A scanner that opens this attachment finds one image-like file with no executable and no archive. The ZIP, its hash and its scripts come into existence later, on the recipient's device. ZenoX makes the point directly: the email gateway never inspects the locally generated ZIP.

This paragraph is AegisAI's analysis. The usual explanations for filter misses, unknown signatures and fresh infrastructure, do not quite fit: here the signature gap is structural, because there is nothing to sign at delivery time. Blind Eagle has hidden payloads from gateways before. MITRE lists password-protected RAR attachments and ZIP, LHA and UUE compressed droppers in its history. HTML smuggling moves the archive and its password out of the email altogether.

What this means for a security team

This section is AegisAI's analysis. For an organization that handles court, tax or public-contracting correspondence in Latin America, or works with those that do, the exposure is a remote access trojan on a workstation that holds sensitive legal and financial documents. ZenoX reports that the lab sample sent judicial and tax documents out over an encrypted channel.

Three questions settle the exposure: are SVG and XHTML attachments from outside the company handled as executable content rather than as images, would a ZIP written by a browser and followed by a script host launch raise an alert, and would anyone be told when AMSI or ETW is tampered with. ZenoX reports no confirmed compromise, so these are readiness questions, not signs of an incident.

Why standard controls miss it

This section is AegisAI's analysis. Attachment controls assume the payload travels with the message, and sender controls assume a clean route means a trustworthy message. This chain breaks both: the message carries a page, not a payload, and the route can be clean. Endpoint controls come last and face a script that has already switched off AMSI and ETW. What stays constant from the first screen to the last stage is the request itself, a court notice that asks to be opened.

How AegisAI protects against it

AegisAI has not observed this campaign. The approach below is how it treats a lure of this shape when it arrives by email.

Aegis does not classify infrastructure. It classifies intent. A lure with no attacker-owned infrastructure still has to ask the recipient to do something on the attacker's behalf, and that request is what gets classified, independent of how clean the destination URL is.

In this chain the request is to open an attached court notice. That is the same request whichever way the file is built.

See a lure like this investigated How inbound protection works

How AegisAI stops credential phishing, 48 seconds

Recommendations for defenders

• Treat SVG and XHTML attachments from external senders as executable content: block them, convert them to a static image, or open them only in isolation.
• Alert on a browser writing a ZIP to disk followed by a script host such as wscript or cscript starting from the user profile, and restrict Windows Script Host to the users who need it.
• Monitor AMSI and ETW for tampering and alert when a script tries to disable either.
• Turn on PowerShell script block logging and alert on payloads that are decoded and loaded in memory.
• Hunt for the persistence artifacts: a Startup-folder shortcut named like SvcConfig*.vbs, files named like index_*.xhtml under %APPDATA%\Microsoft, and the infrastructure listed under reported indicators, re-verifying before any block.
• Tell staff who handle judicial, tax or contracting correspondence to verify unexpected notices through a known channel before opening an attachment, and give them one way to report them.

FAQ