Brazilian Gov Websites Hijacked to Deliver Malware in Active Banking Campaign
Over 20 Brazilian government websites have been quietly repurposed as malware delivery infrastructure in an ongoing campaign called PhantomEnigma, uncovered by sandbox analysis firm ANY.RUN. The operation targets banks and public agencies, and it's been hiding in plain sight behind some of the most trusted digital real estate in Brazil.
Researchers pieced together the campaign by connecting hundreds of sandbox sessions that initially appeared unrelated. The result was an uncomfortably coherent picture of a well-organised attack chain exploiting legitimate infrastructure at multiple stages.
The Hook: Fake Police Documents That Pass Security Checks
The campaign starts with phishing lures styled as official police notices or digital power-of-attorney documents. Some contain QR codes, others just links. What makes them particularly nasty is that many were sent from compromised mailboxes, meaning they sailed through SPF, DKIM, and DMARC authentication checks without raising a flag. Your spam filter sees a legitimate government email account sending a signed message and waves it through.
Victims are then redirected via compromised .gov.br hosts before hitting the actual malicious installer. The government systems aren't the end target here. They're the trusted middleman, providing cover.
Compromised domains included state public security portals, fire department systems, municipal services, and judicial infrastructure. Several appeared across more than one attack arm, which is what allowed researchers to connect the dots.
Two Years of Iteration
PhantomEnigma hasn't stood still. The timeline shows a campaign that started life as a fairly conventional banking-focused operation in 2025, pivoting in 2026 toward abuse of .gov.br infrastructure and authenticated email accounts. The malware itself has evolved from a browser-extension banker into a modular backdoor built on Inno Setup and Node.js.
That modularity is the point. The operator doesn't need to rebuild the infection chain to change what the malware does after it lands. The same installer can eventually deliver a credential stealer, a remote management tool, or something else entirely, depending on what the attacker decides later. Static blocklists and one-time verdicts become largely useless against that kind of flexibility.
What the Backdoor Actually Does
Hidden inside patched legitimate applications, including a modified version of Boostnote, is an index.js backdoor that does considerably more than phone home and wait.
Once active, it fingerprints the infected machine, collects usernames and system details, generates a persistent machine ID, and reads a campaign tag stored alongside the installer. Persistence is established through login settings. Every 180 seconds it checks in with its command infrastructure.
The more interesting capabilities are on the execution side. The backdoor can run JavaScript directly via eval(), pull down and launch executable payloads, and communicate across rotating C2 infrastructure using multiple beacon formats. Rotating infrastructure is a deliberate operational choice to outpace blocklists.
Why This Is a Problem for Security Teams
The fundamental issue here isn't novel malware. It's the trust chain. A .gov.br URL, an authenticated sender, a clean initial file verdict. Each of these individually reduces suspicion. Together they create a window where the infection chain is already running and nobody has flagged anything yet.
For financial institutions and public sector organisations, the downstream consequences aren't limited to one compromised endpoint. Persistent backdoor access means credentials, internal systems, and financial operations can all be in scope before anyone notices fragmented alerts pointing to the same campaign.
Behavioural analysis and proper threat hunting hold up better here than signature-based approaches. And frankly, giving staff a clear, low-friction way to report suspicious official-looking messages without fear of wasting someone's time is underrated. The trusted lure is the most important thing to catch early.