Still Circling: Blind Eagle's Toolkit Keeps Evolving

This report analyzes Blind Eagle's May–July 2026 activity, documenting three distinct VBScript/JS/AutoIt obfuscation dialects, an AutoIt RunPE staging technique via raw.githubusercontent.com, a reused “Photo Studio” persistence artifact across multiple toolchains, and a major AsyncRAT upgrade (JC-46) that adds WNF-based injection, a Base28 encoder, HVNC with browser-profile cloning, and a Chrome ABE v20 bypass; the document includes IOCs (IPs, filenames, SHA-256s, domains), technical reconstructions of novel behaviors, and practical detection/hunting guidance.