Hackers Use Court-Themed Phishing to Deliver Info-Stealer Malware
A sophisticated phishing campaign has been identified, targeting users in Colombia by exploiting judicial notifications and utilizing Scalable Vector Graphics (SVG) files.
A sophisticated phishing campaign has been identified, targeting users in Colombia by exploiting judicial notifications and utilizing Scalable Vector Graphics (SVG) files.
The attack initiates with a Spanish-language email that impersonates the "17th Municipal Civil Court of the Bogotá Circuit." The email is crafted to appear legitimate, using formal legal language and institutional details.
The email includes an SVG attachment titled "Fiscalia General De La Nacion Juzgado Civil 17.svg," which leads recipients into a multi-stage infection chain. This process ultimately delivers the AsyncRAT remote access Trojan (RAT) through in-memory injection into a trusted Windows process.
The phishing email mimics an official court notice, referencing Bogotá’s municipal civil court and presenting a false notification of legal action. The SVG file contains XML-based instructions, including an onclick handler that decodes a Base64-encoded HTML blob, presenting a fake consultation portal that prompts the download of an HTA file.
Clicking "DOWNLOAD DOCUMENTO_OFICIAL_JUZGADO.HTA" executes a client-side dropper. The HTA file contains junk code and decodes a Base64 block into actualiza.vbs .
This process ultimately delivers the AsyncRAT remote access Trojan (RAT) through in-memory injection into a trusted Windows process.
This Visual Basic script writes and runs a PowerShell downloader ( veooZ.ps1 ), which retrieves a text file from an attacker-controlled server. The script processes this file to produce classlibrary3.dll , functioning as a module loader for the AsyncRAT payload.
The loader checks for VirtualBox and VMware processes to avoid sandbox detection, but persistence methods via registry keys are disabled in this campaign.
AsyncRAT executes in memory within MSBuild.exe, gathering system details such as hardware identifiers and operating system version. It uses obfuscation and anti-analysis techniques, including AMSI bypass, to evade detection.
The RAT establishes a TLS-encrypted channel to its command-and-control server, supporting activities like keylogging, file management, and webcam surveillance.
Security teams are advised to monitor for unusual SVG behaviors and enforce strict email attachment policies to mitigate such threats.
Based on reporting by GBHackers.