20+ Hijacked Government Websites Became an Attack Channel
A sophisticated campaign, dubbed PhantomEnigma, has hijacked over 20 Brazilian government websites to deliver malware and conduct attacks against banks and public agencies. Attackers leveraged compromised .gov.br infrastructure and authentic emails to bypass security measures, using a modular backdoor capable of delivering various payloads. This campaign highlights a significant risk for organizations relying on trusted infrastructure, demanding enhanced threat hunting and proactive security measures.
More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN. The investigation revealed previously undocumented backdoor behavior, hidden infrastructure relationships, and multiple attack arms targeting banks and public agencies.
Starting with fake police-themed documents presented as official ‘Ofício Polícia Civil’ or ‘Procuração Digital’ notices, the campaign utilized QR codes and links designed to look like legitimate government resources. Many emails were sent through compromised mailboxes, bypassing SPF, DKIM, and DMARC checks, giving them a stronger appearance of legitimacy than typical phishing emails. Victims were then redirected through compromised .gov.br hosts or police-themed lookalike domains before reaching the malicious installer.
Observed Government Hosts included timon.ma.gov[.]br, loginam.sesp.es.gov[.]br (state public security), aplicacao.cbm.mt.gov[.]br (fire department), prodoc.ap.gov[.]br, and others. These legitimate municipal, public-security, and judicial portals were used at different stages of the delivery chain. Several also appeared across more than one PhantomEnigma attack arm, helping researchers connect activity that initially looked unrelated.
The campaign evolved over time, moving from banking-focused activity in 2025 to abusing compromised .gov.br websites and email accounts in 2026, providing a more trusted route to victims without confirming a new target group. The malware evolved from a browser-extension banker into a modular Inno/Node.js backdoor capable of executing JavaScript and delivering additional payloads.
Once a victim engaged with the lure, the campaign moved through a multi-stage infection chain: a phishing email, redirection through a compromised government host, a malicious installer (using Inno Setup, MSI, or similar), and finally, backdoor activation. The backdoor collected system data, established persistence, and connected to rotating C2 infrastructure. It could then execute JavaScript directly through `eval()`, download and launch executable payloads, and deliver additional malware like stealers, loaders, and remote management tools.
The modular design of the backdoor allows the operator to change the final payload without rebuilding the entire infection chain. A system initially exposed to the same installer could later receive a stealer, loader, or other executable, making both detection and containment more difficult.
Security teams should give employees a safe way to report suspicious official-looking messages and investigate them beyond the initial verdict. Catching the trusted lure early can prevent credential theft, additional payload delivery, and a wider operational incident. Organizations should proactively hunt for indicators of compromise (IOCs) and leverage threat intelligence to strengthen their defenses against this evolving campaign.