# PhantomEnigma Campaign: 20+ Hijacked Brazilian Government Websites Distribute Banking Backdoor via Patched Electron Apps

> The PhantomEnigma campaign, discovered by ANY.RUN, has hijacked 20+ Brazilian (.gov.br) government websites and abused compromised, SPF/DKIM/DMARC-passing email mailboxes to deliver a modular Node.js/Electron backdoor to banks and public agencies. Victims are lured with police-themed phishing documents and QR codes, redirected through trusted government infrastructure, and infected via a patched Electron application (including Boostnote) carrying a hidden malicious index.js backdoor.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1416
- **ID:** TL-2026-1416
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PhantomEnigma is an active malware distribution campaign, tracked by ANY.RUN, that abuses trusted Brazilian government (.gov.br) web infrastructure as a redirect and hosting layer for a multi-stage social-engineering and backdoor-delivery chain. More than 20 government websites have been hijacked, including timon.ma.gov.br, loginam.sesp.es.gov.br (Espírito Santo state public security login portal), aplicacao.cbm.mt.gov.br (Mato Grosso fire department application portal), and prodoc.ap.gov.br, and are being used to host or redirect victims to attacker-controlled infection infrastructure.

The infection chain begins with phishing emails sent from legitimate, compromised mailboxes that pass SPF, DKIM, and DMARC validation, making them appear authentic to mail-filtering controls and end users. The lures impersonate Brazilian police and judicial correspondence — fake documents titled "Ofício Polícia Civil" (Civil Police Official Letter) and "Procuração Digital" (Digital Power of Attorney) — and incorporate QR codes that redirect mobile-scanning victims through the compromised .gov.br infrastructure or through lookalike domains impersonating government portals.

Victims who follow the lure are served malicious installers built with Inno Setup or packaged as MSI files. These installers deploy a patched build of a legitimate Electron desktop application — most notably the open-source note-taking app Boostnote — with a hidden, obfuscated index.js file injected into the Electron app.asar/resources bundle. This index.js is the operative backdoor: on execution it performs system reconnaissance (hostname, username, OS/system details), generates and persists a unique machine identifier for victim tracking, establishes autostart/login-based persistence, and opens a periodic command-and-control channel that checks in roughly every 180 seconds. The backdoor supports direct arbitrary JavaScript execution via eval() of operator-supplied code, as well as downloading and executing secondary EXE payloads, and it rotates across multiple C2 endpoints to resist takedown and blocklisting.

The campaign initially focused on Brazilian banks in 2025 before expanding to public-sector and judicial-portal targets in 2026, consistent with a financially and access-motivated (rather than ideological) objective — using compromised trusted infrastructure and living-off-trusted-mail-servers techniques to defeat conventional domain-reputation and email-authentication defenses. No CVE applies: this is an infrastructure-abuse and social-engineering campaign rather than a vulnerability exploit, and no specific threat-actor group has been publicly attributed as of the source reporting.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1584.001 Domains
- T1586.002 Email Accounts
- T1587.001 Malware
- T1588.001 Malware
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1199 Trusted Relationship
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1505 Server Software Component
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1008 Fallback Channels
- T1102 Web Service
- T1491.002 External Defacement
- T1566.001 Spearphishing Attachment
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1176 Software Extensions
- T1548.002 Bypass User Account Control
- T1112 Modify Registry
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1056.003 Web Portal Capture
- T1518.001 Security Software Discovery
- T1219 Remote Access Tools

## Sources

- [20+ Hijacked Government Websites Distribute Malware via Compromised Email and Fake Documents](https://thehackernews.com/2026/07/20-hijacked-government-websites.html)
- [Brazilian Phishing Campaign Deploys agenteV2 Stealer (related Brazilian banking phishing tradecraft, ANY.RUN)](https://any.run/cybersecurity-blog/brazilian-banking-phishing-campaign/)
- [Rust-Based VENON Malware Targets 33 Brazilian Banks with Credential-Stealing Overlays](https://thehackernews.com/2026/03/rust-based-venon-malware-targets-33.html)
- [WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging](https://thehackernews.com/2026/01/whatsapp-worm-spreads-astaroth-banking.html)
- [Threat Analysis: Backdoored Electron Apps Evading Defenses](https://www.levelblue.com/blogs/spiderlabs-blog/threat-analysis-backdoored-electron-apps-evading-defenses)
- [630K gov.br Subdomains Abused in SEO Poisoning Attack](https://hunt.io/blog/gov-br-subdomain-seo-poisoning-630k-urls)
- [Brazil Gov website serving up phish and malware... again](https://www.netcraft.com/blog/brazil-gov-website-serving-up-phish-and-malware-again)
- [Malicious Browser Extensions Infect Over 700 Users Across Latin America Since Early 2025 (Operation Phantom Enigma, Positive Technologies)](https://thehackernews.com/2025/06/malicious-browser-extensions-infect-722.html)
- [SpiderLabs IDs New Banking Trojan Distributed Through WhatsApp](https://www.levelblue.com/blogs/spiderlabs-blog/spiderlabs-ids-new-banking-trojan-distributed-through-whatsapp)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1416