BLIND EAGLE · CMP-202611-2djbn6 · Other
NO FIX YET · SEE WHAT TO DO
ZenoX (report 4 Nov 2026, covered by The Hacker News 10 Nov) documents a new phishing wave by Blind Eagle (APT-C-36), run from a Brazilian operator cluster, targeting Latin American justice, public-administration and education organizations, especially staff who handle court cases, contracts and official notices. Emails in Spanish and Portuguese imitate court notifications, Fiscalía (Attorney General) notices, tutela proceedings and administrative circulars. The attachment is an SVG disguised as an XHTML file that shows a fake Fiscalía General de la Nación case-lookup page, builds a password-protected ZIP inside the browser (HTML smuggling, so email gateways never see it), and the ZIP holds a JavaScript dropper posing as 'Network Configuration Auditor v2.7.298'. A VBS stage bypasses AMSI/ETW, shows a decoy 'CITACION PENAL, FISCALIA' page, sets up Startup-folder persistence, and PowerShell loads an AsyncRAT fork with DCRat lineage in memory (hidden desktop, keylogger, screen capture, document theft). ZenoX analyzed 12 lure emails; it has no evidence of confirmed victims. Start date of the wave: unknown (report dated 4 Nov 2026).
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
No product ranges from the sources yet.
Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.