Hackers Use Court-Themed Phishing to Deliver Info-Stealer Malware

A novel phishing campaign has emerged targeting Colombian users by abusing judicial notifications and weaponising Scalable Vector Graphics (SVG) files. The attack begins with a Spanish-language email impersonating the “17th Municipal Civil Court of the Bogotá Circuit,” complete with formal legal language and institutional details, including a date of 11 de septiembre de 2025.

The attached SVG file named “Fiscalia General De La Nacion Juzgado Civil 17[.]svg” contains an onclick handler that decodes a Base64 HTML blob and prompts the user to download an HTA file masquerading as an official document, which then launches a multi-stage dropper chain.

When the user clicks DOWNLOAD DOCUMENTO_OFFICIAL_JUZGADO.HTA, a Visual Basic script writes and runs a PowerShell downloader that retrieves a text file from an attacker-controlled server, assembles a .NET DLL loader, and injects the AsyncRAT payload into MSBuild.exe, using in-memory execution and anti-analysis checks including VirtualBox and VMware detection.

AsyncRAT then establishes a TLS-encrypted C2 channel, exfiltrates data with MessagePack, and offers capabilities such as keylogging, file management, remote shell, and webcam surveillance; according to QuickHeal/Seqrite, the SVG attachment showed unusual behaviours during analysis.