Hackers Abuse 20+ Brazilian Government Websites to Spread PhantomEnigma Malware

Hackers are using more than 20 compromised Brazilian government websites to distribute malware through links that appear trustworthy. The active campaign, tracked as PhantomEnigma, primarily targets banking and public-sector organizations in Brazil.

The attackers combine legitimate .gov.br infrastructure, compromised government email accounts, police-themed phishing messages, and frequently changing command-and-control servers. This approach makes malicious emails and downloads harder to distinguish from genuine government communications.

According to the ANY.RUN PhantomEnigma investigation, researchers connected 231 sandbox analyses through a recurring Delphi, Inno Setup, Node.js, and Electron build chain. Approximately 108 to 125 analyses contained stronger indicators directly associated with the campaign.

Government Websites Became Malware Delivery Channels

The attackers compromised legitimate municipal, police, public-security, and fire-department websites across Brazil. They then used those systems to host malicious files or redirect visitors toward attacker-controlled infrastructure.

These government organizations were not necessarily the campaign’s intended victims. Their systems became trusted delivery points that helped attackers reach banking, government, and other Brazilian organizations.

A recipient may trust a download link ending in .gov.br more readily than an unfamiliar domain. Reputation-based security systems can also apply less scrutiny to websites with an established history of legitimate government activity.

Campaign characteristic	ANY.RUN finding
Compromised government hosts	At least 20 Brazilian government websites
Broader build-chain cluster	231 sandbox analyses
Stronger PhantomEnigma indicators	Approximately 108 to 125 analyses
Ofício-PC activity	99 sandbox analyses
Primary geographic focus	Brazil
Observed activity	January through July 2026
Peak months	March and May 2026
Attribution confidence	High for the campaign, medium-high for the specific Inno and Node.js arm

Compromised Mailboxes Help Phishing Pass Authentication

Researchers recovered an email sent from a Brazilian police department that passed SPF, DKIM, and DMARC authentication. This indicates that attackers likely used a genuinely compromised mailbox or authorized mail system.

SPF, DKIM, and DMARC help receiving services determine whether a message came through infrastructure authorized by the sender’s domain. They primarily defend against forged sender information and do not prove that the person controlling an authenticated account is trustworthy.

Microsoft’s guidance on anti-phishing protection notes that impersonation can pass SPF, DKIM, and DMARC when attackers control an authenticated source or properly configured lookalike domain. Additional behavioral and impersonation checks remain necessary.

Phishing Emails Impersonate Brazilian Police

The malicious messages use themes such as “Polícia Civil,” “Ofício Polícia Civil,” and “Procuração Digital.” Some direct recipients to compromised government hosts, while others use police-themed lookalike domains controlled by the attackers.

The wording creates urgency around official notices, legal documents, investigations, or digital authorizations. A victim who follows the link receives a Windows installer presented as a legitimate document or government application.

Security teams should avoid describing every message as spoofed. Some campaign emails use impersonation or lookalike domains, but evidence shows that at least one message likely came through a compromised official mailbox.

How the PhantomEnigma Infection Chain Works

The download commonly arrives as an executable built with Inno Setup and compiled using Delphi. One observed file used the name Procuracao_Digital.exe to support the official-document lure.

When launched, the installer silently extracts a modified Electron application. Researchers identified a patched version of Boostnote, a legitimate note-taking application, containing a malicious index.js file.

Electron applications use JavaScript and Node.js components. The attackers abuse that trusted application structure to load their backdoor while making the installed package appear more ordinary.

Attack stage	Observed behavior
Phishing delivery	The victim receives a police or digital-authorization email.
Trusted link	The message links to a compromised government host or police-themed lookalike domain.
Installer download	The host provides a Delphi-compiled Inno Setup executable.
Electron deployment	The installer extracts a patched Boostnote or another JavaScript-based application.
Backdoor execution	Electron loads an obfuscated malicious index.js file.
System discovery	The backdoor collects system and user information and performs reconnaissance.
Persistence	The malware configures a Windows Run key and application login settings.
Command execution	The server can return JavaScript or send another executable payload.

The JavaScript Backdoor Collects System Information

After Electron loads index.js, the script deobfuscates itself and gathers information about the infected system. Collected data can include the computer name, username, domain details, and a campaign-specific identifier.

The backdoor can launch child processes to perform additional reconnaissance. It then sends the collected information to an attacker-controlled command-and-control server.

Persistence allows the malware to run again after the user signs in. Researchers observed both a Windows Run registry entry and Electron’s setLoginItemSettings functionality in related samples.

Attackers Can Send JavaScript or Executable Payloads

PhantomEnigma uses a modular command structure. The command-and-control server can return JavaScript for execution inside the running Electron process.

The backdoor processes this code through eval(), which allows the server to change its instructions without requiring the attackers to replace the initial installer.

The server can also send a complete executable file. The backdoor writes the second-stage payload to the computer and launches it as a child process.

• Information stealers
• Malware loaders
• Remote access tools
• Banking credential theft components
• Additional reconnaissance utilities

Researchers Found a New Backdoor Generation

ANY.RUN analysts detonated a sample again on July 12, 2026, and observed a previously undocumented communication pattern in a live environment.

An earlier backdoor generation sent a GET request to a /laravel.php endpoint. The newly observed version sent victim information through a POST request to an /nbw/ path.

The new beacon communicated with zsxocjarsate[.]com, confirming that the domain was receiving system information during the live test. The finding indicates that at least two backdoor generations operated during the campaign.

Backdoor generation	Request method	Observed path
Earlier generation	GET	/laravel.php
Newly documented generation	POST	/nbw/

Two PhantomEnigma Attack Arms Operated Together

The activity initially appeared to involve separate attack waves. One used fake Ofício Polícia Civil PDF documents and QR codes, while another distributed the Inno Setup and Node.js backdoor.

Researchers later found that the two operations overlapped. At least four compromised government hosts delivered both Ofício-PC content and PhantomEnigma installers.

The shared infrastructure, police-themed lures, delivery evidence, and timing support the assessment that the QR-code campaign represents another arm of the same operation. ANY.RUN assigns medium-high confidence to this connection.

QR Codes Direct Victims Toward Malicious Content

The Ofício-PC campaign uses fake police documents containing QR codes. Scanning the code directs victims toward a malicious website or another stage of the infection chain.

QR-code phishing, also called quishing, can hide the final destination from email scanners that inspect conventional text links. It may also move the victim from a managed computer to a less-protected mobile device.

The Ofício-PC cluster produced 99 sandbox analyses. Researchers kept other adjacent ClickFix and StealC activity separate because available evidence did not support a confident operator-level connection.

PhantomEnigma Evolved From an Earlier Banking Campaign

Positive Technologies documented an earlier Phantom Enigma operation in 2025. That version used malicious browser extensions to target Brazilian banking information, particularly data associated with Banco do Brasil.

The original Phantom Enigma research described phishing emails, PowerShell, browser shortcut modification, remote administration tools, and extensions installed in Chromium-based browsers.

The 2026 activity adds a modular Electron and Node.js backdoor while retaining a strong focus on Brazil. Compromised government infrastructure represents a change in delivery rather than proof that the campaign selected government organizations as a new victim category.

Researchers Used the Build Chain as a Fingerprint

Domains, IP addresses, and compromised hosts changed frequently, but the underlying malware construction remained more consistent. Analysts repeatedly found the combination of Delphi, Inno Setup, Node.js, Electron, and an obfuscated index.js backdoor.

That build chain identified 231 related sandbox analyses. However, the broader technical match does not establish the same attribution confidence for every sample.

Approximately 108 to 125 analyses also included stronger PhantomEnigma indicators. These included known command-and-control infrastructure, government delivery hosts, beacon IP addresses, and the /laravel.php or /nbw/ communication patterns.

Detection level	Evidence	Recommended use
Broad build-chain match	Delphi, Inno Setup, Node.js, and Electron characteristics	Threat hunting and investigation
Higher-confidence campaign match	Build chain plus known C2, beacon paths, IP addresses, or compromised government hosts	Prioritized incident response
Behavioral confirmation	System collection, persistence, beacon traffic, or second-stage execution	Containment and forensic investigation

One Seed Domain Appeared in Only 15% of Analyses

The policiacivilmg[.]com domain became a widely referenced indicator for the campaign. However, it appeared in only about 15% of the analyzed sessions.

A detection rule based only on that domain would therefore miss approximately 85% of the wider dataset. This demonstrates the limited lifespan of static indicators in campaigns with frequently changing infrastructure.

Security teams should combine domains with installer characteristics, JavaScript patterns, process behavior, persistence, and network paths. This provides better coverage when attackers replace individual servers.

Command-and-Control Infrastructure Changes Frequently

PhantomEnigma separates delivery websites, beacon servers, origin systems, and exfiltration infrastructure. Cloudflare also concealed some origin systems behind proxy services.

Researchers observed government delivery hosts and associated C2 domains changing together over several weeks. The operator appears capable of moving to new infrastructure without redesigning the malware.

ANY.RUN expects this rotation to continue. Future versions may rely more heavily on encrypted HTTPS traffic, which would reduce the usefulness of plaintext network signatures.

Nearly One-Third Initially Received Clean Verdicts

Almost one-third of the activity reviewed by ANY.RUN initially received a clean automated verdict. Some samples revealed malicious behavior only after deeper sandbox inspection and correlation with related activity.

In one correlation test, researchers combined the recurring build chain with network indicators. This identified 59 analyses, including nine that had initially received clean verdicts.

A clean result should not end an investigation when a suspicious government-themed installer creates persistence, launches child processes, or contacts unfamiliar infrastructure.

SPF, DKIM, and DMARC Are Not Content Safety Checks

Email authentication can confirm that a message traveled through a domain’s authorized infrastructure. It does not examine whether the sender’s account was compromised or whether a link leads to malware.

Lookalike domains can also configure valid SPF, DKIM, and DMARC records. A message can therefore pass authentication while still impersonating a police department, government organization, or trusted company.

Organizations should combine email authentication with the impersonation controls described in Microsoft’s anti-phishing policy documentation, along with URL analysis, attachment inspection, account monitoring, and behavioral detection.

How Organizations Can Detect PhantomEnigma

Defenders should focus on the malware’s recurring behavior rather than treating every .gov.br link as safe or malicious. Broadly blocking Brazilian government domains could interfere with legitimate public services.

• Inspect unexpected government emails even when authentication checks pass.
• Verify police, legal, tax, and digital-authorization notices through a separate channel.
• Analyze QR codes and shortened links before allowing users to open them.
• Sandbox unfamiliar Inno Setup installers from government-themed messages.
• Monitor Electron applications that load unexpected or obfuscated index.js files.
• Detect Node.js child processes performing system reconnaissance.
• Alert on unusual Windows Run-key changes after installer execution.
• Monitor traffic to /laravel.php and /nbw/ paths.
• Correlate Delphi, Inno Setup, Node.js, and Electron detections.
• Review clean verdicts when suspicious process or network behavior remains.

The complete ANY.RUN investigation recommends initially deploying behavioral and network rules in monitoring mode. Security teams can then check for false positives before enabling automated blocking.

The earlier Positive Technologies analysis also provides detection context for PhantomEnigma’s browser-extension, PowerShell, and banking-focused activity.

Selected Compromised Government Hosts

The following legitimate Brazilian government domains appeared in the delivery infrastructure. They have been defanged to prevent accidental access. Their presence does not mean that every page or service on each domain remains malicious.

Compromised government host	Role
areal[.]rj[.]gov[.]br	Malicious delivery or redirection
camaradelassance[.]mg[.]gov[.]br	Malicious delivery or redirection
camaraparaguacu[.]sp[.]gov[.]br	Malicious document and installer hosting
circ[.]rs[.]gov[.]br	Malicious delivery infrastructure
condemat[.]sp[.]gov[.]br	Malicious delivery infrastructure
ferrazdevasconcelos[.]sp[.]gov[.]br	Malicious delivery infrastructure
floresdegoias[.]go[.]gov[.]br	Malicious delivery infrastructure
funrespol[.]pc[.]ro[.]gov[.]br	Police-related government delivery host
lontra[.]mg[.]gov[.]br	Malicious delivery infrastructure
marapoama[.]sp[.]gov[.]br	Malicious delivery infrastructure
pinhalgrande[.]rs[.]gov[.]br	Malicious delivery infrastructure
poa[.]sp[.]gov[.]br	Malicious download delivery
protocolo[.]sorocaba[.]sp[.]gov[.]br	Shared across related delivery activity
seplag[.]mt[.]gov[.]br	Malicious delivery infrastructure
policiacivil[.]pe[.]gov[.]br	Police-related government delivery host

Selected Attacker-Controlled Indicators

Security teams should handle attacker-owned infrastructure differently from compromised government systems. The following indicators can support threat hunting, but attackers may replace them quickly.

Type	Indicator	Description
Domain	policiacivilmg[.]com	Police-themed seed and delivery domain
Domain	pccvill[.]com	Police-themed lookalike domain
Domain	zsxocjarsate[.]com	Live C2 observed with the /nbw/ POST beacon
Network path	/laravel.php?api=api&hash=	Earlier beacon generation
Network path	/nbw/	Newly documented POST beacon generation
JavaScript behavior	String.fromCharCode decoding with system-information collection	Recurring index.js backdoor characteristic
Persistence	HKCU\Software\Microsoft\Windows\CurrentVersion\Run	Observed Windows logon persistence

Because infrastructure rotates quickly, organizations should not rely on these indicators alone. Build-chain analysis, endpoint telemetry, sandbox behavior, YARA rules, and current threat intelligence provide more durable detection.

FAQ