Fake Federal Court Emails Target South Florida Businesses With Malware

Oct 28, 2026 2 min read All South Florida Money & Consumer Alerts

Quick answer

The U.S. District Court for the Southern District of Florida warned today that fraudulent emails posing as court ADR notices are circulating — the case numbers do not exist and the emails are not from the court. Researchers say the campaign targets more than 100,000 companies and installs password-stealing malware.

Key facts

The U.S. District Court for the Southern District of Florida posted an advisory saying it received several reports today of fraudulent emails purportedly sent from the court, referencing a court-appointed mediator and an Alternative Dispute Resolution (ADR) matter.
The court says the case numbers in the emails — its sample cites ADR Conference ID No. 6:26-cv-12667-ADR and similar variations — do not exist in its system, and the emails do not originate from the court.
ThreatDown researchers reported October 28 that the campaign targets more than 100,000 companies with personalized emails and a fake court portal, and that opening the downloaded 'case file' installs LodaRAT, malware that can steal saved passwords, record keystrokes, audio and video, and give attackers remote control of the computer.
The court's guidance: do not click links or open attachments in a suspicious message about an unrecognized case; verify any court matter directly through the court's official phone number or website before acting.

The federal court for South Florida is warning businesses not to trust emails that claim to come from it. In an advisory posted on its official website, the U.S. District Court for the Southern District of Florida said it received several reports today of fraudulent emails referencing a court-appointed mediator and an Alternative Dispute Resolution matter — and that the case numbers do not exist in its system and the emails do not originate from the court.

The lure is built to look personal. ThreatDown researchers, who published their analysis on October 28, say each email carries the target company's name and a unique ADR ID, and links to a fake court portal that urges the reader to download a "case file." Opening it installs LodaRAT, malware that can steal saved browser passwords, record keystrokes, audio and video, and hand remote control of the PC to attackers. The researchers estimate more than 100,000 companies are targeted.

Why it matters: a court notice is exactly the kind of email a busy practice or small-business office opens quickly. If you receive one, do not click any link or attachment and do not download the file. Verify any real court matter through the court's official website or phone number, and warn staff who handle the office inbox.