A sophisticated cyberattack campaign, known as PhantomEnigma, has been identified leveraging compromised Brazilian government websites to distribute malware. This operation has infiltrated over 20 official “.gov.br” domains, including municipal and police portals, transforming them into trusted conduits for malicious payloads aimed at banking and public-sector organizations.
The attackers gained unauthorized access to legitimate government email accounts, enabling them to dispatch phishing emails that successfully pass authentication protocols such as SPF, DKIM, and DMARC. These emails, masquerading as communications from entities like “Polícia Civil” or “Procuração Digital” notaries, contain links directing recipients to the compromised government sites or to domains mimicking official police websites.
Upon clicking these links, victims inadvertently download a Delphi-compiled Inno Setup installer. This installer discreetly deploys a modified Electron application, such as an altered version of the Boostnote note-taking app, which conceals a malicious JavaScript backdoor within its index.js file. Once executed, this backdoor deobfuscates itself, collects system data from the victim’s machine, and transmits it to a command-and-control (C2) server. It also performs reconnaissance using the child_process module and establishes persistence by adding a Windows Run key.
The C2 server can then issue commands executed via the eval() function or deliver additional payloads, such as information stealers or remote access tools, as part of a second-stage attack. Notably, researchers have observed a new variant of this backdoor that sends a POST request to a “/nbw/” path, indicating the operation of multiple backdoor generations concurrently.
Further investigation has linked a separate QR-code phishing campaign, involving fake “Ofício Polícia Civil” PDF documents, to the same threat actors. Several compromised government hosts, including protocolo.sorocaba.sp.gov.br and prodoc.ap.gov.br, have been used to distribute both the Ofício-PC content and PhantomEnigma installers, suggesting a coordinated operation.
The campaign’s infrastructure is highly dynamic, with C2 domains and IP addresses rotating almost weekly, rendering static blocklists ineffective. For instance, the domain policiacivilmg.com appeared in only 15% of the analyzed sandbox sessions, indicating that domain-based detection methods may miss a significant portion of the activity.
Instead, the consistent use of Delphi/Inno Setup and Node.js/Electron in the malware’s build chain serves as a more reliable indicator, identifying all related sessions despite changes in infrastructure. Alarmingly, nearly one-third of the malicious samples initially received clean verdicts from automated tools, delaying containment efforts.
The exploitation of trusted government infrastructure poses significant risks, including banking fraud, exposure of sensitive data, operational disruptions, and increased incident response costs. Security professionals are advised to approach compromised .gov.br and .jus.br domains with caution, as outright blocking could disrupt legitimate government services. Implementing sandbox behavioral analysis, YARA-based build-chain detection, and continuously updated threat intelligence feeds can provide more robust protection than relying solely on domain or hash-based detection methods.
This incident underscores the critical need for government agencies to fortify their cybersecurity defenses and for organizations to remain vigilant against increasingly sophisticated phishing campaigns that exploit trusted sources.
