A malware operation researchers are calling PhantomEnigma has found an unusually effective way to get past email security controls: hijacking the very government infrastructure those controls are designed to trust. The campaign has compromised at least 20 official Brazilian “.gov.br” municipal and police websites, using them as launch points for malware aimed at banking customers and public-sector employees.

Abusing Trust Instead of Breaking It

Rather than spoofing a government domain, the attackers behind PhantomEnigma appear to have gained genuine access to legitimate government mailboxes. That access lets their phishing emails pass SPF, DKIM, and DMARC checks — the same authentication protocols that are supposed to catch spoofed senders. Because the messages originate from real, trusted infrastructure, they sail through defenses built to flag forged mail.

Victims receive emails impersonating Brazil’s civil police (“Polícia Civil”) or a notary service (“Procuração Digital”), pointing to links hosted on the compromised government sites themselves or on convincing police-themed lookalike domains.

From a Click to a Backdoor

Clicking through triggers an Inno Setup installer, compiled in Delphi, that quietly deploys a modified Electron application — researchers spotted a tampered version of the Boostnote note-taking app — with a malicious index.js file hidden inside as a backdoor.

Once running, the backdoor unpacks itself, reports system information back to a command-and-control server, uses child processes to survey the infected machine, and sets up persistence through a Windows Run registry key. From there, the operators can either send commands to execute directly through JavaScript’s eval() function or push down a full second-stage payload, such as an information stealer or remote access tool.

A Second, Newer Version of the Backdoor

Analysts at ANY.RUN identified a previously undocumented version of the backdoor during a live sample analysis in mid-July 2026. Where an earlier variant used a GET request to a /laravel.php path, the newer one sends a POST request to a /nbw/ path instead, and researchers confirmed the associated command-and-control domain was actively receiving stolen data. That finding indicates the group is running at least two distinct backdoor generations at the same time.

Researchers also tied a separate QR-code phishing operation — using fake “Ofício Polícia Civil” documents — to the same actor, after finding that some of the same compromised government hosts served both the QR-phishing content and the PhantomEnigma installers.

Why Blocklists Keep Missing It

PhantomEnigma’s infrastructure rotates on a near-weekly basis, which undercuts detection strategies built around static domain or IP blocklists. Researchers found that even the most frequently cited command-and-control domain appeared in only a small fraction of the sessions they analyzed, meaning domain-based detection alone misses the majority of the activity.

What has proven more durable is the malware’s build chain — its consistent use of Delphi and Inno Setup packaging combined with a Node.js/Electron payload. That signature let researchers identify all of the related samples they examined, even as the surrounding infrastructure kept changing. Notably, close to a third of the malicious samples initially received clean verdicts from automated scanning tools, which likely delayed detection and containment at some organizations.

What Defenders Should Do

Because the campaign relies on genuinely compromised government infrastructure rather than attacker-owned servers, security teams are advised to handle these hosts carefully. Recommended steps include:

• Treating compromised .gov.br and .jus.br hosts differently from attacker-owned infrastructure, since blanket blocking could disrupt legitimate public services
• Prioritizing behavioral and build-chain detection (YARA rules targeting the Delphi/Inno Setup and Electron packaging) over static domain or hash blocklists
• Feeding continuously updated threat intelligence into email and endpoint defenses rather than relying on one-time indicator lists
• Training staff to treat emails referencing police or notary matters with added scrutiny, even when they appear to come from legitimate government senders

The Bigger Risk

The abuse of trusted government infrastructure raises the stakes well beyond a typical phishing campaign. Potential consequences include banking fraud against individuals, exposure of sensitive personal or case data, disruption to public services, and rising incident-response costs for the affected municipalities and agencies. As long as authentication checks continue to trust the underlying domain rather than verifying the actual sender’s intent, campaigns like PhantomEnigma will keep finding ways to turn institutional trust into an attack surface.