PhantomEnigma Campaign: 20+ Hijacked Brazilian Government Websites Distribute Banking Backdoor via Patched Electron Apps
PhantomEnigma Campaign (TL-2026-1416), also tracked as Operation PhantomEnigma, is a high-severity malware campaign, first published 2026-07-16. It has no confirmed attribution, affects Boostnote Boostnote (Electron desktop app), maps to 41 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1416
- Threat ID
- TL-2026-1416
- Also known as
- Operation PhantomEnigma
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-16
- Last reviewed
- 2026-07-16
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- banking, government administration, publicsafety, judicial
- Target regions
- brazil, 005 - South America
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in PhantomEnigma Campaign
Malware and tooling: PhantomEnigma backdoor, Boostnote (trojanized build), MeshCentral Agent (abused for remote access), PDQ Connect
The PhantomEnigma campaign, discovered by ANY.RUN, has hijacked 20+ Brazilian (.gov.br) government websites and abused compromised, SPF/DKIM/DMARC-passing email mailboxes to deliver a modular Node.js/Electron backdoor to banks and public agencies. Victims are lured with police-themed phishing documents and QR codes, redirected through trusted government infrastructure, and infected via a patched Electron application (including Boostnote) carrying a hidden malicious index.js backdoor.
How PhantomEnigma Campaign works
PhantomEnigma is an active malware distribution campaign, tracked by ANY.RUN, that abuses trusted Brazilian government (.gov.br) web infrastructure as a redirect and hosting layer for a multi-stage social-engineering and backdoor-delivery chain. More than 20 government websites have been hijacked, including timon.ma.gov.br, loginam.sesp.es.gov.br (Espírito Santo state public security login portal), aplicacao.cbm.mt.gov.br (Mato Grosso fire department application portal), and prodoc.ap.gov.br, and are being used to host or redirect victims to attacker-controlled infection infrastructure.
The infection chain begins with phishing emails sent from legitimate, compromised mailboxes that pass SPF, DKIM, and DMARC validation, making them appear authentic to mail-filtering controls and end users. The lures impersonate Brazilian police and judicial correspondence — fake documents titled "Ofício Polícia Civil" (Civil Police Official Letter) and "Procuração Digital" (Digital Power of Attorney) — and incorporate QR codes that redirect mobile-scanning victims through the compromised .gov.br infrastructure or through lookalike domains impersonating government portals.
Victims who follow the lure are served malicious installers built with Inno Setup or packaged as MSI files. These installers deploy a patched build of a legitimate Electron desktop application — most notably the open-source note-taking app Boostnote — with a hidden, obfuscated index.js file injected into the Electron app.asar/resources bundle. This index.js is the operative backdoor: on execution it performs system reconnaissance (hostname, username, OS/system details), generates and persists a unique machine identifier for victim tracking, establishes autostart/login-based persistence, and opens a periodic command-and-control channel that checks in roughly every 180 seconds. The backdoor supports direct arbitrary JavaScript execution via eval() of operator-supplied code, as well as downloading and executing secondary EXE payloads, and it rotates across multiple C2 endpoints to resist takedown and blocklisting.
The campaign initially focused on Brazilian banks in 2025 before expanding to public-sector and judicial-portal targets in 2026, consistent with a financially and access-motivated (rather than ideological) objective — using compromised trusted infrastructure and living-off-trusted-mail-servers techniques to defeat conventional domain-reputation and email-authentication defenses. No CVE applies: this is an infrastructure-abuse and social-engineering campaign rather than a vulnerability exploit, and no specific threat-actor group has been publicly attributed as of the source reporting.
MITRE ATT&CK techniques used in TL-2026-1416
Collection
T1005 Data from Local System; T1185 Browser Session Hijacking
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1574 Hijack Execution Flow
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery
Credential Access
T1056.003 Web Portal Capture; T1539 Steal Web Session Cookie
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1106 Native API; T1204.002 Malicious File
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Persistence
T1176 Software Extensions; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution; T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1199 Trusted Relationship; T1566 Phishing; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link; T1566.003 Spearphishing via Service
Impact
Privilege Escalation
T1548.002 Bypass User Account Control
Resource Development
T1584.001 Domains; T1586.002 Email Accounts; T1587.001 Malware; T1588.001 Malware
Reconnaissance
Affected products and versions in PhantomEnigma Campaign
- Boostnote — Boostnote (Electron desktop app)
Vulnerable versions: trojanized/patched installer builds distributed outside official channels
Fixed in: N/A - use only official signed Boostnote releases from the vendor - Government of Brazil — .gov.br web infrastructure (multiple state/municipal portals)
Vulnerable versions: timon.ma.gov.br; loginam.sesp.es.gov.br; aplicacao.cbm.mt.gov.br; prodoc.ap.gov.br; 16+ additional unnamed .gov.br hosts
Remediation for PhantomEnigma Campaign
Immediate actions
- Block/alert on outbound C2 beacons occurring at ~180-second intervals from unexpected Electron/Node.js processes
- Quarantine and re-verify integrity of Electron application installers (Boostnote and similar) obtained outside official vendor channels
- Flag and inspect inbound email containing QR codes combined with police/judicial-themed government branding, even when SPF/DKIM/DMARC pass
- Audit .gov.br web properties (and any government/public-sector web assets under an organization's remit) for unauthorized content, redirects, or injected links
- Hunt for hidden or unexpectedly obfuscated index.js files inside Electron app.asar/resources directories on endpoints
Workarounds
- Restrict installation of Electron-based third-party applications (e.g., Boostnote) to vetted, centrally-managed software distribution
- Block known compromised .gov.br redirect hosts and lookalike domains at DNS/web proxy layer pending official remediation
Longer-term hardening
- Deploy EDR/behavioral detection capable of flagging Electron/Node.js processes performing eval() of remote/dynamic JavaScript
- Implement code-signing and installer-integrity verification for all Electron-based desktop software allowed in the environment
- Establish continuous monitoring/threat hunting for anomalous outbound beaconing rather than relying solely on static IOC blocklists
- Coordinate with Brazilian federal/state government CERTs to remediate and monitor hijacked .gov.br infrastructure
- Deliver targeted employee awareness training on police/judicial-themed phishing lures and QR-code redirection abuse
Timeline of PhantomEnigma Campaign
- PhantomEnigma-related activity initially concentrated on Brazilian banks in early 2025, per ANY.RUN's tracked timeline of the actor's tradecraft, consistent with the Positive Technologies precursor reporting.
- Positive Technologies tracks the start of the earlier 'Operation Phantom Enigma' precursor activity: phishing-delivered malicious Chromium browser extensions (Chrome/Edge/Brave) targeting Brazilian banking credentials, particularly Banco do Brasil accounts, via injected JavaScript token interception and fraudulent in-browser QR codes.
- Positive Technologies publicly discloses 'Operation Phantom Enigma', reporting ~722 malicious-extension infections across roughly 70 victim companies in Brazil, Colombia, Czech Republic, Mexico, Russia, and Vietnam, phishing emails sent from compromised-company mail servers, PowerShell anti-VM/anti-Diebold-Warsaw checks, UAC-disabling batch scripts, forced extension installation via the ExtensionInstallForcelist policy, and PING/PONG C2 heartbeat commands.
- Campaign scope expands into 2026 to include public agencies and judicial portals in addition to banking targets.
- Researchers identify a patched Boostnote Electron application build containing a hidden malicious index.js backdoor used as the campaign's final-stage payload, replacing the earlier browser-extension delivery method with an Electron-app trojanization technique.
- ANY.RUN observes and documents 20+ hijacked Brazilian .gov.br government websites being abused as redirect/hosting infrastructure for the campaign.
- Campaign publicly attributed to discovery by the ANY.RUN malware analysis platform.
- The Hacker News publishes public disclosure of the PhantomEnigma campaign, detailing the hijacked government websites, compromised-mailbox phishing, QR-code lures, and Electron-based backdoor.
Sources cited for PhantomEnigma Campaign
- 20+ Hijacked Government Websites Distribute Malware via Compromised Email and Fake Documents
- Brazilian Phishing Campaign Deploys agenteV2 Stealer (related Brazilian banking phishing tradecraft, ANY.RUN)
- Rust-Based VENON Malware Targets 33 Brazilian Banks with Credential-Stealing Overlays
- WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging
- Threat Analysis: Backdoored Electron Apps Evading Defenses
- 630K gov.br Subdomains Abused in SEO Poisoning Attack
- Brazil Gov website serving up phish and malware... again
- Malicious Browser Extensions Infect Over 700 Users Across Latin America Since Early 2025 (Operation Phantom Enigma, Positive Technologies)
- SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp
Threats related to PhantomEnigma Campaign
- Edgecution: Payouts King Initial Access Broker Deploys Malicious Microsoft Edge Extension with Embedded Python Backdoor
- StealC Infostealer and Amadey Loader Malware-as-a-Service Cybercrime Ecosystem (Operation Endgame Disruption)
- Fake Google/Cloudflare Verification Pages Spread Multiple Malware Families via ClickFix (HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, ResiLoader)
Detection coverage for TL-2026-1416
As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1416 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.