Researchers tracked the Blind Eagle threat actor from May to July 2026, observing multiple exposed staging servers that revealed significant evolution in their toolkit. The toolkit now includes a third string-obfuscation scheme using JavaScript with a custom AES S-box substitution, a RunPE loader leveraging a bare AutoIt3 interpreter staged via GitHub, and a reusable 'Photo Studio' persistence mechanism shared across three toolchains. Additionally, the AsyncRAT variant JC-46 was materially upgraded to incorporate Windows Notification Facility process injection, custom Base28 encoding, Hidden VNC capabilities for banking fraud with browser profile cloning, and a bypass of Chrome App-Bound Encryption v20. The group exhibits selective sophistication despite operational security flaws such as exposed directories and hardcoded credentials, focusing on banking targets in Spanish-speaking countries.

The threat actor's toolkit enhancements enable more sophisticated malware deployment and persistence, including advanced obfuscation and process injection techniques. The upgraded AsyncRAT JC-46 variant facilitates stealthy remote access, banking fraud via hidden VNC, and credential theft through browser profile cloning and Chrome encryption bypass. These capabilities increase the risk of financial theft and compromise of sensitive banking credentials in targeted regions. Operational security weaknesses may provide defenders with detection opportunities, but the evolving toolkit poses a medium-level threat to banking operations in affected countries.

No official patches or fixes are available as this is a malware toolkit used by a threat actor rather than a software vulnerability. Defenders should monitor for indicators of compromise such as the listed IP addresses (178.16.52.80, 64.89.160.17, 181.235.8.24), domain (rema200426.duckdns.org), and file hashes provided. Implementing detection for the described techniques (e.g., RunPE loaders, process injection, AsyncRAT variants) and restricting AutoIt3 interpreter usage may help mitigate infection. Since the threat actor exhibits operational security weaknesses, leveraging exposed directories and hardcoded credentials for threat hunting could be effective. No vendor advisory or patch information is available; patch status is not applicable.