Fake Brazilian notary-office domains incl. 1protestorecife.com spread Overlord RAT via bogus legal notices
Hackread reported on October 23, 2026 that WatchGuard researcher Euler Neto identified eight fraudulent domains impersonating Brazilian protest notary offices, including 1protestorecife.com and cartorioquintela.com, u…
- First reported
- Reports
- 1
Source: hackread.com · published
What happened
Hackread reported on October 23, 2026 that WatchGuard researcher Euler Neto identified eight fraudulent domains impersonating Brazilian protest notary offices, including 1protestorecife.com and cartorioquintela.com, used in phishing emails posing as legal notices. Links in the emails include valid CNPJ numbers to look legitimate; clicking downloads an obfuscated VBScript that fetches further files from Dropbox or Google Cloud Storage, uses PowerShell and curl, may add Microsoft Defender exclusions, abuses legitimate apps such as ngentask.exe and VLC to load malicious DLLs, and ultimately runs Overlord RAT, which communicates with 191.96.225.125 and 45.158.8.213 (port 5173). The malware references Brazilian financial institutions including C6Bank, PicPay, Banco Inter and Caixa Econômica Federal.
How the scam works
The lure relies on fear: an email that looks like a formal protest notice from a notary office suggests the recipient has an unpaid debt that will be registered against them. Including a valid CNPJ (company registration number) makes the notice look checkable. The link downloads a script instead of a document. Hackread says the infection chain uses trusted cloud storage and legitimate Windows programs to avoid detection. One variant creates scheduled tasks named 'Windows Error Reporting' to stay on the computer, and a Go-based loader decrypts a file called werdata.db (using the Chaskey cipher) into Donut shellcode before Overlord RAT is launched.
A remote access trojan lets attackers control the infected PC remotely, which can include stealing passwords and banking details. That is why the references to Brazilian banks matter. WatchGuard's wider research also covers a Lampion banking-trojan campaign and a separate remote-access campaign targeting users in Portugal. Real Brazilian notary offices are impersonated and are not involved.
Source
Hackread, "Overlord RAT Uses Fake Legal Notices to Infect Windows PCs in New Campaign" (published 23 October 2026).
Red flags
- An unexpected email claiming to be a protest notice from a notary office.
- A link that downloads a script file (.vbs) rather than opening a PDF.
- A sender domain such as 1protestorecife.com or cartorioquintela.com that isn't an official notary site.
- Pressure to act quickly to avoid a debt being registered.
If you were targeted
- 1Don't click links or open attachments in unexpected legal notices.
- 2Check any protest notice through the official notary office or Brazil's official protest-registry services, using details you find yourself.
- 3If you ran a downloaded file, disconnect the PC from the internet and run a full scan with up-to-date security software.
- 4Change banking and email passwords from a clean device and contact your bank.
- 5Organisations should block the listed domains and the IP addresses 191.96.225.125 and 45.158.8.213.
- 6Report the email to your IT or security team.