Hackers Got Hacked — An Infostealer Exposed Blind Eagle’s Entire Arsenal

• The Mess: An infostealer infected a workstation apparently used by a Blind Eagle-linked operator, exposing RAT builders, phishing kits, crypters, infrastructure records and malware delivery tools. Researchers traced the machine back through a GitHub account and leaked stealer logs.
• The Damage: The compromised workstation revealed multiple RAT families, phishing infrastructure and credentials that could expose the operator’s entire attack pipeline — turning the attackers’ own operational security failure into an intelligence goldmine.
• The Fix: Hunt for Blind Eagle-style delivery chains using VBScript, PowerShell, AutoIt and signed Windows utilities, while monitoring GitHub, Bitbucket and cloud-storage downloads from unusual processes.

The attackers were supposed to steal the data.

Instead, someone stole theirs.

A commodity infostealer infected a workstation apparently used by an operator linked to Blind Eagle, exposing the machinery behind a malware campaign targeting Colombian users.

Researchers didn’t just find one payload.

They found the factory.

The Trail Started on GitHub

The investigation began with the GitHub account cabeto850128.

The account had been used to stage components of a malicious loader.

Then researchers noticed something most attackers forget about:

Git commit metadata.

The commit exposed the email address associated with the author.

That email became the pivot.

Researchers found it in an ALIEN TXTBASE stealer log, where it appeared alongside credentials and information captured from an infected machine.

The victim wasn’t a normal victim.

The machine appeared to belong to someone operating malware infrastructure.

And then the researchers opened the files.

The Folder Was Literally Called “Rats”

Inside the compromised workstation was a directory named:

Rats

It contained build directories for multiple remote-access trojans, including:

• AsyncRAT
• DcRat
• Remcos
• Quasar RAT
• XWorm

There were also artifacts suggesting previous RAT operations, including system-information files associated with different machines.

This wasn’t somebody experimenting with one piece of malware.

It looked like a toolkit.

Multiple RAT families.

Multiple builds.

Multiple delivery mechanisms.

A threat actor with options.

Then Came the Phishing Kits

The machine also contained phishing templates impersonating Colombian government and judicial institutions.

One lure pretended to be a notification from the Consejo Superior de la Judicatura.

Another impersonated Bogotá’s traffic authority.

The objective was simple:

Make the victim believe the message is official.

Get them to open an archive.

Start the infection chain.

The templates specifically encouraged recipients to use a PC or laptop, fitting a Windows-focused malware delivery process.

Social engineering doesn’t need to be sophisticated when the branding does most of the work.

The Delivery Chain Was Built for Windows

Researchers reconstructed a multi-stage chain involving:

RAR → VBScript → PowerShell → InstallUtil.exe → RAT

The attackers abused legitimate Windows utilities as part of the execution process.

That matters because defenders can’t simply block an unknown executable and declare victory.

InstallUtil.exe is legitimate.

PowerShell is legitimate.

VBScript is legitimate.

The malicious part is what they are being used to execute.

LevelBlue recommends watching for combinations such as wscript.exe or cscript.exe spawning PowerShell, AutoIt interpreters running scripts from user-writable directories, and suspicious use of signed Windows utilities including InstallUtil.exe, RegSvcs.exe, MSBuild.exe and jsc.exe.

The Operator Was Preparing Mass Delivery

The workstation contained SendBlaster, a bulk-email application configured with an external SMTP relay.

Logs showed a completed test email sent to the same operational address associated with the GitHub activity.

Browser history also showed activity involving services such as:

• Brevo
• Mailrelay
• HubSpot
• DreamHost
• HostGator
• Firebase

That’s not a malware sample anymore.

That’s an operation.

Infrastructure.

Hosting.

Email delivery.

Payload building.

Phishing.

Everything was sitting on one compromised workstation.

They Were Buying Evasion

Researchers also discovered evidence of activity involving several crypters and protectors, including FUD Crypter, MI6 Crypter, PolyCrypt and Cassandra Protector.

At least one commercial crypter subscription appeared to have been purchased.

The purpose is obvious.

Make malware harder for security products to detect.

So the operator wasn’t simply downloading RATs.

They were maintaining a pipeline for building, modifying, protecting and distributing them.

GitHub Was Only One Piece

The infrastructure stretched across multiple legitimate services.

Researchers identified:

• GitHub
• Bitbucket
• AWS S3
• DuckDNS
• hosting providers
• bulk-email platforms

One GitHub repository contained the loader.

Another repository appeared later in August.

The same account was still active after the original investigation, suggesting the operator had not simply abandoned the infrastructure.

That makes the compromise particularly valuable for defenders.

The workstation wasn’t a historical snapshot.

It exposed an operation that was still evolving.

The Irony Is Almost Perfect

Blind Eagle is known for phishing campaigns and commodity RAT deployment across Latin America.

LevelBlue’s earlier research documented continued evolution of the group’s tooling during 2026, including AutoIt-based loading, new obfuscation techniques and updated AsyncRAT capabilities.

Then one of the machines apparently supporting that ecosystem was compromised by exactly the kind of malware threat actors use against everyone else.

An infostealer.

The attacker became the victim.

The victim became the intelligence source.

And the security researchers got the keys to the workshop.

What Defenders Should Hunt

The most useful lesson isn’t the embarrassing part.

It’s the behavior.

Security teams should investigate:

• wscript.exe or cscript.exe spawning PowerShell
• AutoIt interpreters executing scripts from writable directories
• suspicious InstallUtil.exe execution
• unusual MSBuild.exe, RegSvcs.exe or jsc.exe activity
• Photo Studio-related scheduled-task persistence
• RAT-like outbound connections
• suspicious GitHub or Bitbucket payload downloads
• password-protected archives arriving through phishing
• browser credential theft followed by unusual outbound traffic

Hash-based detection won’t be enough.

The operator can rebuild the payload.

The behavior remains.

Bugstoday Opinion

There is something beautifully stupid about this incident.

Blind Eagle built an ecosystem around stealing other people’s credentials.

Then an infostealer walked into the operator’s own machine and stole the operator’s credentials, browser history, tools and malware infrastructure.

One compromised workstation exposed:

RATs → phishing → crypters → email delivery → hosting → C2 → GitHub staging.

That’s an entire criminal supply chain sitting on one machine.

The attackers didn’t get breached by some legendary zero-day.

They got hit by the same commodity malware that makes their own business possible.

Bugstoday verdict: operational security matters even when your operation is criminal. Blind Eagle spent months building a malware pipeline and apparently lost the blueprint because somebody opened the wrong file.

Today’s Bugs. Tomorrow’s Breaches.