Reported by 2 outlets

Timeline

1. original reporting

   Blind Eagle-Linked Loader Uses GitHub, VBScript, PowerShell and InstallUtil to Deploy AsyncRAT

   cyberpress.org · 43d ago · August 31st, 2026

   Researchers have uncovered a Blind Eagle-linked malware operation that uses GitHub repositories , phishing lures, VBScript, PowerShell, and the legitimate Windows InstallUtil utility to deploy AsyncRAT on victim systems. The investigation began with the GitHub account cabeto850128, which was used to host components of a malware loader. The account’s comicsam repository stored an AutoIt interpreter and separate script content, allowing attackers to update malicious logic without repeatedly uploading a modified executable. A GitHub commit exposed an email address in its author metadata. Researchers used that address as a pivot and found it in a leaked infostealer log collection. Additional compromise intelligence linked the address to a device named “Ghost,” which had apparently been infected by an unrelated information-stealing malware family. The recovered stealer log provided a rare look into what appears to be an attacker-side workstation. It contained browser artifacts, local directories, phishing templates, RAT-building tools, bulk-email software, hosting records, and evidence of commercial crypter use. The findings suggest that the GitHub repository was only one part of a wider malware delivery pipeline. Blind Eagle Deploys AsyncRAT The analyzed samples were self-extracting RAR archives disguised as legitimate-looking files, including invoice and PDF-themed attachments. When opened, the archive launches a VBScript-based dropper. The initial script uses wscript.exe to exe

2. update from gbhackers.com

   Infostealer Infection Exposes Blind Eagle-Linked Operator’s Malware Production Pipeline

   gbhackers.com · 43d ago · August 31st, 2026

   A compromised attacker-side workstation has given researchers an unusual view into the operational ecosystem behind a suspected Blind Eagle malware campaign, exposing RAT builders, phishing templates, bulk-mail tooling, crypter activity and infrastructure tracking records. Rather than directly exposing a modified executable, the account hosted a legitimate AutoIt interpreter alongside separately retrievable malicious script logic an […] The post Infostealer Infection Exposes Blind Eagle-Linked Operator’s Malware Production Pipeline appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .