An active malware campaign, dubbed PhantomEnigma, that abuses compromised Brazilian government infrastructure to distribute malicious payloads while evading detection.
The operation has hijacked at least 20 official “.gov.br” municipal and police portals, using them as trusted delivery points for malware targeting banking and public-sector organizations.
Attackers gained access to legitimate government mailboxes, allowing phishing emails to pass SPF, DKIM, and DMARC authentication checks the very protocols designed to block spoofed senders.
Victims receive spoofed “Polícia Civil” or “Procuração Digital” notary emails containing links to compromised government hosts or police-themed lookalike domains.
Clicking these links triggers a Delphi-compiled Inno Setup installer that silently deploys a patched Electron application, such as a modified Boostnote note-taking app, hiding a malicious index.js backdoor inside.
Once activated, this backdoor deobfuscates itself, transmits victim system data to a command-and-control (C2) server, performs reconnaissance through child_process, and establishes persistence via a Windows Run key.
The server can then respond with JavaScript executed directly through eval(), or push a full executable payload such as a stealer or remote access tool as a second-stage attack.
A Newly Discovered Backdoor Variant
Researchers also connected a separate QR-code phishing (quishing) operation using fake “Ofício Polícia Civil” PDF documents — to the same threat actor.
At least four compromised government hosts, including protocolo.sorocaba.sp.gov[.]br and prodoc.ap.gov[.]br, delivered both the Ofício-PC content and PhantomEnigma installers, strengthening the assessment that these are two arms of one coordinated operation.
The campaign’s C2 domains and IP addresses rotate on a near-weekly basis, making static blocklists quickly outdated. Notably, the most cited seed domain, policiacivilmg[.]com, appeared in only 15% of the 231 sandbox sessions analyzed, showing that domain-based detection alone misses two-thirds of the activity.
Instead, the malware’s recurring Delphi/Inno Setup and Node.js/Electron build chain served as its most durable fingerprint, identifying all 231 related sessions even as infrastructure changed.
Nearly one-third of the malicious samples initially received clean verdicts from automated tools, delaying containment. The abuse of trusted government infrastructure creates risks including banking fraud, sensitive data exposure, operational disruption, and rising incident response costs.
Security leaders are advised to treat compromised .gov.br and .jus.br hosts differently from attacker-owned infrastructure, since blocking them outright could disrupt legitimate government services.
Combining sandbox behavioral analysis, YARA-based build-chain hunting, and continuously updated threat intelligence feeds offers more durable protection than relying on individual domains or hashes alone.
