PureHVNC RAT Distributed via Weaponized Judicial Documents

The campaign uses judicial document themes to deliver Hijackloader malware, which then deploys the PureHVNC remote access trojan (RAT). According to IBM X-Force, this is the first observed instance of this delivery chain being used against Spanish-speaking users in Latin America, with activity detected between August and October 2025 targeting Colombian users via emails impersonating the country’s Attorney General’s office.

The attackers distribute a password-protected ZIP archive after victims open a Google Drive-hosted document, with the password shown on the download completion page to prompt extraction and execution of the malicious binary. Hijackloader’s multi-stage infection chain includes DLL side-loading, legitimate file renaming to a judiciary-themed name, and loading of PureHVNC into legitimate system processes, aided by anti-analysis and anti-virtualization techniques.

The campaign marks a tactical shift for LATAM threat actors, combining established delivery infrastructure with a payload toolkit that includes PureHVNC, a malware-as-a-service tool sold on underground forums and Telegram channels. Defenders are urged to tighten email filtering, disable SVG previews in cloud storage, and deploy behavioural analysis tools to detect DLL side-loading and process injection techniques.