Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

Summary: Check Point Research has tracked a Chinese-speaking cluster it calls Gambling Goblin since mid-2025 installing malicious Apache modules on compromised Brazilian government and educational web servers, reverse-proxying visitors to phishing pages that mimic Google Play, Microsoft Store, and Amazon while stripping the sites' security headers. ANY.RUN separately reported in July that at least 20 .gov.br portals belonging to Brazilian municipalities and police forces were used to distribute malware, and Hunt.io said it found more than 630,000 URLs generated on hijacked gov.br subdomains serving keyword-stuffed pages to Googlebot while redirecting real users to betting sites.
What you should know: The published material includes no count of compromised servers and no module filenames, paths, or hashes, so administrators cannot check what is loaded into their own Apache instances; and because the pages already mimic app-download destinations, Check Point says the operators sit one step from pushing malware straight to victims.

Read the original at The Hacker News ↗