Global Malware Campaign Abuses Fake Court Communications

Researchers have uncovered a global phishing campaign where threat actors send fake judicial notifications that impersonate government or court entities. These deceptive emails contain attachments labeled as “court documents,” “summons,” or “legal proceedings”, urging victims to download or view the files.

Once opened, the files deploy malware payloads that steal credentials, install backdoors, and enable remote system control. This campaign demonstrates how social engineering using legal pressure remains one of the most effective phishing lures.

From Email to Compromise

The malicious emails follow a structured delivery chain designed to mimic authentic government communication. Attackers use domains resembling official court portals and digitally styled letterheads to enhance legitimacy.

Each message includes urgent legal language, such as “Failure to appear may result in penalties,” prompting users to open the attachment. The attached files typically contain macro-enabled Word documents or PDFs with embedded JavaScript, which fetch malware executables from compromised web servers. Once executed, the payload establishes persistence via registry keys, connects to command-and-control (C2) servers, and downloads modules for data exfiltration and credential theft.

Security researchers identified multiple malware strains deployed through this campaign, including:

• Agent Tesla used for keylogging and credential harvesting.

• AsyncRAT  provides remote desktop control and data exfiltration.

• FormBook captures browser data, clipboard content, and credentials.

• GuLoader used to download secondary payloads and encrypt communications.

The phishing emails originate from compromised mail servers and abuse legitimate hosting services like Google Drive and Dropbox to host malicious payloads.
The infrastructure rotates frequently, using fast-flux DNS to evade takedown attempts.

Why the Judicial Theme Works

Attackers leverage the psychological authority of legal systems to pressure recipients into compliance.
Users fear missing critical court summons or fines, making them more likely to ignore basic security caution.

This emotional manipulation, combined with official-looking branding, results in an exceptionally high open rate. Such tactics have proven more effective than generic phishing attempts due to their contextual believability.

Global Impact and Target Profile

Researchers have tracked victims in North America, Europe, and the Asia-Pacific region, spanning:

• Law firms and financial institutions.

• Government contractors.

• SMEs handling sensitive correspondence.

• Individual users targeted through webmail accounts.

While the campaign appears opportunistic, its infrastructure and techniques overlap with known financially motivated threat actors, including TA571 and TA551.

Cybersecurity experts urge organizations to implement the following measures:

• Train employees to identify urgent legal-sounding lures.

• Disable macros and script execution in office documents.

• Use sandboxed environments to scan email attachments.

• Implement multi-factor authentication (MFA) for email access.

• Monitor network logs for suspicious outbound C2 connections.

Additionally, organizations should leverage threat intelligence feeds to identify and block phishing domains as they emerge.

The fake judicial notification campaign proves that social engineering remains a powerful attack vector in 2025. By exploiting legal fear and trust in authority, attackers continue to bypass even advanced security tools. Defenders must pair technical controls with human awareness training, ensuring users question any unexpected legal communication. In today’s threat landscape, skepticism is security.

FAQs

Q1. What are fake judicial notification emails?
They are phishing messages impersonating courts or government entities that deliver malware via attachments.

Q2. What malware is used in this campaign?
Researchers found Agent Tesla, AsyncRAT, and FormBook among the distributed payloads.

Q3. Who is behind these attacks?
Attribution points to financially motivated threat groups known for phishing operations.

Q4. How can users avoid infection?
Avoid opening unexpected legal documents and verify email senders through official court channels.

Q5. Why do these attacks work so well?
Because legal authority creates psychological urgency, causing victims to act before verifying authenticity.