20+ Hijacked Government Websites Became
an Attack Channel

The PhantomEnigma campaign has hijacked over 20 Brazilian government websites, leveraging compromised .gov.br domains and authenticated email accounts to distribute malware. The attack uses fake police-themed documents to lure victims, redirecting them through trusted government infrastructure to deliver a modular Inno/Node.js backdoor. This backdoor enables credential theft, remote access, and delivery of additional payloads, posing significant risks to banks and public agencies.

AI-extracted · verify before operational use