ANY.RUN threat researchers have exposed PhantomEnigma, an active campaign that has compromised over 20 legitimate Brazilian government websites (.gov.br domains) and the email accounts associated with them, using that trusted infrastructure to deliver a modular Node.js backdoor to banking and public-sector organizations across Brazil. The campaign began as a browser-extension banker in 2025 before evolving into a sophisticated, multi-stage operation that now leverages Electron-wrapped installers to load the Node.js implant.
The attack chain is notable for its operational security: phishing emails use fake Polícia Civil or official-document lures, routing victims through the compromised .gov.br hosts to download Inno Setup or MSI installers. Because the email originates from a legitimate government account, it passes SPF, DKIM, and DMARC authentication checks cleanly. Researchers have also linked the campaign to “Ofício-PC quishing” activity — QR code PDF lures and ClickFix-style social engineering — indicating a coordinated operation with multiple delivery channels. The Node.js backdoor is capable of executing arbitrary JavaScript, collecting system data, establishing persistence, and connecting to rotating C2 infrastructure.
Source
- The Hacker News — 20 Hijacked Government Websites Delivering Malware
- ANY.RUN Blog — Hidden Infrastructure Exposed
Commentary
PhantomEnigma’s core insight is elegant and alarming: you don’t need to fake trust when you can borrow it. Compromising a real government email account and web presence means every downstream protection — email authentication, browser warnings, user training about “checking the sender domain” — is neutralized. This is a pattern red teamers should study carefully: gaining initial access to a low-security, high-trust entity (a municipal government site, an NGO, an academic institution) and pivoting to use that trust as the delivery mechanism against higher-value targets.
Defenders should add .gov.br domain email traffic to their anomalous-delivery monitoring queue, particularly for executables or macro-enabled documents. The ClickFix and QR-code quishing variants demonstrate that the operator is actively testing which delivery vector generates the highest click-through rate — a hallmark of a well-resourced and persistent threat actor.