A concerning malware campaign, known as PhantomEnigma, has emerged, utilizing compromised Brazilian government websites to discreetly distribute harmful software. The attackers have taken over more than 20 municipal and police portals under the “.gov.br” domain, leveraging their credibility to target financial and public sector entities.
Methods of Compromise and Distribution
The attackers infiltrated legitimate government email systems, enabling them to bypass stringent email authentication protocols such as SPF, DKIM, and DMARC. As a result, phishing emails masquerading as communications from official bodies like the “Polícia Civil” or through “Procuração Digital” notaries could circulate freely, embedding links to compromised government sites or deceptive police-themed domains.
Recipients clicking on these links unknowingly download a Delphi-compiled Inno Setup installer, which discreetly installs a tampered Electron application. This application, a modified version of the Boostnote note-taking app, conceals a harmful index.js backdoor that activates upon installation.
Technical Details of the Malware
Once deployed, the backdoor becomes active, obfuscates itself, and transmits system data to a command-and-control (C2) server. It conducts reconnaissance and establishes persistence through a Windows Run key. The C2 server can then send JavaScript for execution or deliver a secondary payload, such as a data-stealing tool or remote access software.
ANY.RUN analysts have identified a new backdoor variant during an examination on July 12, 2026. Unlike its predecessor, which utilized a GET request to a /laravel.php endpoint, this version uses a POST request to a /nbw/ path, verifying active data reception by the C2 domain zsxocjarsate[.]com.
Impact and Threat Mitigation
The malware campaign’s operators have been linked to a separate phishing operation that uses fake “Ofício Polícia Civil” PDFs. At least four compromised government sites, including protocolo.sorocaba.sp.gov[.]br, have been used to distribute both the malware and phishing content, indicating a coordinated strategy.
Rotating C2 domains and IP addresses weekly complicate efforts to create effective blocklists. The primary domain, policiacivilmg[.]com, appeared in only a minority of analyzed sessions, highlighting the inefficacy of domain-based detection alone. Instead, the malware’s recurring Delphi/Inno Setup and Node.js/Electron build chain provide a more reliable fingerprint for identifying related sessions.
Security professionals must consider compromised .gov.br and .jus.br hosts distinct from attacker-controlled infrastructure to avoid disrupting legitimate services. Employing sandbox behavioral analysis, YARA-based detection, and dynamic threat intelligence can offer more robust defenses than relying solely on domain or hash identification.
Organizations are encouraged to integrate advanced monitoring tools like ANY.RUN with their Security Operations Center (SOC) to enhance threat detection and response capabilities.
