PhantomEnigma Campaign: 20+ Hijacked Brazilian Government Websites Distribute Banking Backdoor via Patched Electron Apps

PhantomEnigma Campaign (TL-2026-1416), also tracked as Operation PhantomEnigma, is a high-severity malware campaign, first published 2026-07-16. It has no confirmed attribution, affects Boostnote Boostnote (Electron desktop app), maps to 41 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-1416

Threat ID
TL-2026-1416
Also known as
Operation PhantomEnigma
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
banking, government administration, publicsafety, judicial
Target regions
brazil, 005 - South America
Detection rules
9
Indicators of compromise
23

Malware and tooling in PhantomEnigma Campaign

Malware and tooling: PhantomEnigma backdoor, Boostnote (trojanized build), MeshCentral Agent (abused for remote access), PDQ Connect

The PhantomEnigma campaign, discovered by ANY.RUN, has hijacked 20+ Brazilian (.gov.br) government websites and abused compromised, SPF/DKIM/DMARC-passing email mailboxes to deliver a modular Node.js/Electron backdoor to banks and public agencies. Victims are lured with police-themed phishing documents and QR codes, redirected through trusted government infrastructure, and infected via a patched Electron application (including Boostnote) carrying a hidden malicious index.js backdoor.

How PhantomEnigma Campaign works

PhantomEnigma is an active malware distribution campaign, tracked by ANY.RUN, that abuses trusted Brazilian government (.gov.br) web infrastructure as a redirect and hosting layer for a multi-stage social-engineering and backdoor-delivery chain. More than 20 government websites have been hijacked, including timon.ma.gov.br, loginam.sesp.es.gov.br (Espírito Santo state public security login portal), aplicacao.cbm.mt.gov.br (Mato Grosso fire department application portal), and prodoc.ap.gov.br, and are being used to host or redirect victims to attacker-controlled infection infrastructure.

The infection chain begins with phishing emails sent from legitimate, compromised mailboxes that pass SPF, DKIM, and DMARC validation, making them appear authentic to mail-filtering controls and end users. The lures impersonate Brazilian police and judicial correspondence — fake documents titled "Ofício Polícia Civil" (Civil Police Official Letter) and "Procuração Digital" (Digital Power of Attorney) — and incorporate QR codes that redirect mobile-scanning victims through the compromised .gov.br infrastructure or through lookalike domains impersonating government portals.

Victims who follow the lure are served malicious installers built with Inno Setup or packaged as MSI files. These installers deploy a patched build of a legitimate Electron desktop application — most notably the open-source note-taking app Boostnote — with a hidden, obfuscated index.js file injected into the Electron app.asar/resources bundle. This index.js is the operative backdoor: on execution it performs system reconnaissance (hostname, username, OS/system details), generates and persists a unique machine identifier for victim tracking, establishes autostart/login-based persistence, and opens a periodic command-and-control channel that checks in roughly every 180 seconds. The backdoor supports direct arbitrary JavaScript execution via eval() of operator-supplied code, as well as downloading and executing secondary EXE payloads, and it rotates across multiple C2 endpoints to resist takedown and blocklisting.

The campaign initially focused on Brazilian banks in 2025 before expanding to public-sector and judicial-portal targets in 2026, consistent with a financially and access-motivated (rather than ideological) objective — using compromised trusted infrastructure and living-off-trusted-mail-servers techniques to defeat conventional domain-reputation and email-authentication defenses. No CVE applies: this is an infrastructure-abuse and social-engineering campaign rather than a vulnerability exploit, and no specific threat-actor group has been publicly attributed as of the source reporting.

MITRE ATT&CK techniques used in TL-2026-1416

Collection

T1005 Data from Local System; T1185 Browser Session Hijacking

Command and Control

T1008 Fallback Channels; T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1574 Hijack Execution Flow

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery

Credential Access

T1056.003 Web Portal Capture; T1539 Steal Web Session Cookie

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1106 Native API; T1204.002 Malicious File

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Persistence

T1176 Software Extensions; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution; T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service

Impact

T1491.002 External Defacement

Privilege Escalation

T1548.002 Bypass User Account Control

Resource Development

T1584.001 Domains; T1586.002 Email Accounts; T1587.001 Malware; T1588.001 Malware

Reconnaissance

T1591 Gather Victim Org Information

Affected products and versions in PhantomEnigma Campaign

  • Boostnote — Boostnote (Electron desktop app)
    Vulnerable versions: trojanized/patched installer builds distributed outside official channels
    Fixed in: N/A - use only official signed Boostnote releases from the vendor
  • Government of Brazil — .gov.br web infrastructure (multiple state/municipal portals)
    Vulnerable versions: timon.ma.gov.br; loginam.sesp.es.gov.br; aplicacao.cbm.mt.gov.br; prodoc.ap.gov.br; 16+ additional unnamed .gov.br hosts

Remediation for PhantomEnigma Campaign

Immediate actions

  • Block/alert on outbound C2 beacons occurring at ~180-second intervals from unexpected Electron/Node.js processes
  • Quarantine and re-verify integrity of Electron application installers (Boostnote and similar) obtained outside official vendor channels
  • Flag and inspect inbound email containing QR codes combined with police/judicial-themed government branding, even when SPF/DKIM/DMARC pass
  • Audit .gov.br web properties (and any government/public-sector web assets under an organization's remit) for unauthorized content, redirects, or injected links
  • Hunt for hidden or unexpectedly obfuscated index.js files inside Electron app.asar/resources directories on endpoints

Workarounds

  • Restrict installation of Electron-based third-party applications (e.g., Boostnote) to vetted, centrally-managed software distribution
  • Block known compromised .gov.br redirect hosts and lookalike domains at DNS/web proxy layer pending official remediation

Longer-term hardening

  • Deploy EDR/behavioral detection capable of flagging Electron/Node.js processes performing eval() of remote/dynamic JavaScript
  • Implement code-signing and installer-integrity verification for all Electron-based desktop software allowed in the environment
  • Establish continuous monitoring/threat hunting for anomalous outbound beaconing rather than relying solely on static IOC blocklists
  • Coordinate with Brazilian federal/state government CERTs to remediate and monitor hijacked .gov.br infrastructure
  • Deliver targeted employee awareness training on police/judicial-themed phishing lures and QR-code redirection abuse

Timeline of PhantomEnigma Campaign

  • PhantomEnigma-related activity initially concentrated on Brazilian banks in early 2025, per ANY.RUN's tracked timeline of the actor's tradecraft, consistent with the Positive Technologies precursor reporting.
  • Positive Technologies tracks the start of the earlier 'Operation Phantom Enigma' precursor activity: phishing-delivered malicious Chromium browser extensions (Chrome/Edge/Brave) targeting Brazilian banking credentials, particularly Banco do Brasil accounts, via injected JavaScript token interception and fraudulent in-browser QR codes.
  • Positive Technologies publicly discloses 'Operation Phantom Enigma', reporting ~722 malicious-extension infections across roughly 70 victim companies in Brazil, Colombia, Czech Republic, Mexico, Russia, and Vietnam, phishing emails sent from compromised-company mail servers, PowerShell anti-VM/anti-Diebold-Warsaw checks, UAC-disabling batch scripts, forced extension installation via the ExtensionInstallForcelist policy, and PING/PONG C2 heartbeat commands.
  • Campaign scope expands into 2026 to include public agencies and judicial portals in addition to banking targets.
  • Researchers identify a patched Boostnote Electron application build containing a hidden malicious index.js backdoor used as the campaign's final-stage payload, replacing the earlier browser-extension delivery method with an Electron-app trojanization technique.
  • ANY.RUN observes and documents 20+ hijacked Brazilian .gov.br government websites being abused as redirect/hosting infrastructure for the campaign.
  • Campaign publicly attributed to discovery by the ANY.RUN malware analysis platform.
  • The Hacker News publishes public disclosure of the PhantomEnigma campaign, detailing the hijacked government websites, compromised-mailbox phishing, QR-code lures, and Electron-based backdoor.

Sources cited for PhantomEnigma Campaign

Threats related to PhantomEnigma Campaign

Detection coverage for TL-2026-1416

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1416 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats