Fake U.S. court ADR phishing campaign targets more than 100,000 companies, delivers LodaRAT

A phishing campaign impersonating the United States District Court for the Southern District of Florida is targeting more than 100,000 companies, according to ThreatDown research published October 27, 2026. Each target receives a personalized email with a unique Alternative Dispute Resolution (ADR) ID linking to a fake court portal at florida.courtadr.com, which serves a password protected ZIP containing an ISO with three files. All three files download the same LodaRAT remote access trojan, disguised as Taskmgr.exe, SystemSettings.exe and msedge.exe from us.wind0ws.net. ThreatDown says LodaRAT steals browser and Wi-Fi credentials, logs keystrokes, captures screen, webcam and audio, enables remote desktop access and can spread over local networks and USB. No confirmed infection count has been published.

The court has issued its own advisory confirming the fraudulent emails, stating that the ADR case numbers cited do not exist in its system and that the emails do not originate from the court, and warning recipients not to click links or open attachments.

Sources: ThreatDown; U.S. District Court, Southern District of Florida; HackRead