20+ Hijacked Government Websites Became an Attack Channel
Summary: ANY.RUN researchers uncovered a PhantomEnigma campaign in which more than 20 Brazilian government websites were hijacked and used as malware delivery channels, with lures styled as official "Ofício Polícia Civil" or "Procuração Digital" notices, some carrying QR codes. Several emails were sent through compromised mailboxes and passed SPF, DKIM, and DMARC checks, and victims were redirected through compromised .gov.br hosts such as timon.ma.gov[.]br and loginam.sesp.es.gov[.]br before reaching a modular index.js backdoor hidden in a patched Boostnote and other applications.
What's compelling: The campaign moved from banking-focused activity in 2025 to abusing compromised .gov.br sites and email accounts in 2026, and a modular backdoor lets the operator swap in a stealer, loader, or remote management tool without rebuilding the infection chain - so a clean verdict at the first download tells you little about what lands next.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026