Hijacked Brazilian Gov Sites Were Feeding Malware, Says ANY.RUN

When you think of a government website you probably picture a clean, official looking page – maybe a bit stiff, but certainly safe. In reality, a recent investigation by the interactive sandbox ANY.RUN shows that at least twenty Brazilian .gov.br sites have been quietly turned into malware distribution points. The operation, which researchers have dubbed PhantomEnigma, has been active since early 2026 and is still leaking fresh samples.

What makes this campaign especially unsettling is how it hides in plain sight. The attackers first seized genuine municipal and police portals – URLs like marapoama.sp.gov.br, poa.sp.gov.br or areal.rj.gov.br – and then used the compromised mailboxes to send phishing messages that passed every authentication check (SPF, DKIM and DMARC). Recipients saw a perfectly legitimate‑looking notice from “Polícia Civil” or a “Procuração Digital” document, and the email’s link led straight to the infected host.

Once a victim clicked, the download wasn’t a simple executable. The payload is a layered beast built with a Delphi‑compiled Inno Setup installer that, in turn, drops a patched Node.js/Electron application. In other words, the malicious code walks a hybrid path: native Windows binaries for initial persistence, then a JavaScript‑heavy front‑end that talks back to the attackers’ command‑and‑control servers.

Analysis of the sandbox data – 231 runs recorded between 15 January and 10 July 2026 – revealed two distinct beacon families. The older “Generation A” simply polls a /laravel.php?api=… endpoint, while the newer “Generation B” posts data to a /nbw/ URL. The latter was confirmed alive on 12 July when a live detonation reproduced the exact network traffic observed in the wild.

Who’s the intended victim? The evidence points straight at the banking sector. Besides the obvious lure of stealing credentials, the researchers noted that the payload was often delivered to users of Banco do Brasil and other financial institutions, suggesting a two‑stage attack: first harvest personal data via the phishing email, then use the compromised government host as a trusted delivery channel for the banking‑focused malware.

All of this is stitched together by a handful of shadowy C2 domains – names like policiacivilmg.com and pccvill.com keep popping up in the traffic logs. Those domains resolve to servers that, based on WHOIS records, appear to be registered in jurisdictions far from Brazil, a classic move to muddy the attribution trail.

The takeaway is clear: a compromised .gov.br address can bypass many of the email‑security checks that organizations rely on. If you’re handling any suspicious messages, treat a seemingly official government domain with the same caution you would a public‑facing one. And for security teams, the lesson is to monitor not just the usual malware indicators but also the health of the public‑sector infrastructure you depend on.