Brazilian Government Sites Turned Into Malware Traps in PhantomEnigma Campaign

Key points

• ANY.RUN's threat intelligence team disclosed a campaign, tracked as PhantomEnigma, that hijacked more than 20 Brazilian government websites and used them to serve malware.
• The trusted .gov.br domains delivered a previously undocumented backdoor, a hidden program that lets attackers control an infected computer remotely.
• Investigators found several attack arms sharing hidden infrastructure, suggesting one coordinated operation rather than opportunistic defacements.
• The campaign is still active, and any Brazilian citizen who downloaded files from an official state site recently should treat their machine as potentially exposed.

Criminals broke into more than 20 Brazilian government websites and quietly turned them into malware delivery points. Anyone visiting those pages and expecting a public document could end up with spyware instead.

The campaign is called PhantomEnigma. ANY.RUN, a company that runs suspicious files in a sealed test environment to see what they do, uncovered it. Their writeup, picked up by The Hacker News, describes a coordinated operation with several moving parts. We first covered PhantomEnigma on 16 July 2026, as part of a run of Brazil-focused threat reporting that now stretches to nine stories.

How did the hackers get in?

The researchers haven't published a full root cause yet, but the pattern is familiar. Campaigns like this usually start with a weak content management system, an outdated plugin, or stolen admin credentials from a phishing email, where criminals send fake login pages to trick staff into handing over passwords.

Once inside, the attackers didn't deface the sites. That would've set off alarms. Instead they left the pages looking normal and slipped malicious downloads underneath. A visitor sees a legitimate .gov.br address in the browser bar and trusts it. That trust is the whole point.

The payload is a backdoor that hadn't been documented before. A backdoor gives an outsider remote control of the infected machine: reading files, watching keystrokes, installing more malware later. ANY.RUN also found infrastructure links tying several apparently separate attacks back to the same operator.

Why hijack a government site instead of building a fake one?

Because the padlock and the official domain do the persuasion work for you. Security filters and careful users are far less likely to block a link to a real .gov.br address. The failure mode here is trust in the domain rather than trust in the file.

That also makes cleanup hard. Every hijacked site needs its own incident response: find the web shell (the small script the attackers use to keep access), rebuild the server, then rotate every credential. Multiply that by 20-plus agencies, most of which don't share a single security team, and you're looking at weeks of work.

What should ordinary people do?

If you downloaded a file from a Brazilian government website recently and something felt off, an unexpected prompt or a browser warning you clicked past, get the machine scanned by up-to-date antivirus. Change the passwords you've typed since then, especially for banking and email. Turn on two-factor authentication, the second code sent to your phone, on any account that offers it.

For the agencies themselves, the postmortem will almost certainly note that nobody was watching outbound traffic from the web servers. Hijacked government sites don't usually need to talk to anonymous hosting providers. When they do, that should page someone.

Should you worry?

If you're a developer or security lead touching Brazilian government infrastructure, yes. The broader lesson applies anywhere: if citizens trust your public website, treat every file it serves like a signed release artifact, not a shared folder anyone can write to. This campaign shares a structural similarity with the GigaWiper backdoor we covered on 10 July, where trusted delivery paths were used to mask a payload that did far more than it appeared to.