Loading story…
Researchers reported an active PhantomEnigma malware campaign that hijacked more than 20 Brazilian government-related websites and abused compromised mailboxes to distribute a modular Windows backdoor. Victims were lured with fake police or notary-style documents and redirected through compromised .gov.br and police-themed domains tied to municipal, judicial, fire department, and other public-sector infrastructure, giving the infection chain the appearance of legitimacy.
The malware was delivered as a Delphi-compiled Inno Setup installer that unpacked a patched Electron/Node.js application. Once installed, PhantomEnigma collected host information, established persistence, contacted rotating command-and-control servers roughly every 180 seconds, executed JavaScript, and downloaded additional payloads including stealers, loaders, and remote management tools. Investigators linked 231 sandbox analyses from January through July 2026 to the operation, indicating a sustained campaign that turned trusted government web assets into malware delivery infrastructure.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ANY.RUN published research describing an active PhantomEnigma campaign that used at least 20 compromised Brazilian government-related and public-sector websites, along with compromised mailboxes, to deliver a modular Windows backdoor via fake document lures and a patched Electron/Node.js application.
ANY.RUN linked 231 sandbox analyses to the PhantomEnigma campaign over the period from January through July 2026, indicating sustained activity during that timeframe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetrojan-killer.net
Open sourceany.run
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
eSentire reported a resurging malware operation dubbed **Resident** targeting manufacturing, commercial, and healthcare organizations. The campaign, active since late 2022 and likely run by native Russian-speaking operators, used phishing emails and drive-by downloads from compromised WordPress sites to deliver JavaScript payloads that installed MSI packages, VBS scripts, screenshot utilities, and a **Node.js-based backdoor**. Across multiple incidents, the attackers also deployed custom Resident backdoors, **Cobalt Strike** loaders and beacons, reconnaissance tools, and persistence mechanisms to maintain access. The intrusion chain relied on repeated MSI retrieval, host profiling, screenshot capture, command execution, and scheduled-task or startup persistence to support follow-on activity after initial compromise. In one case, the operators attempted to deploy the **Rhadamanthys** stealer, indicating an interest in credential and data theft alongside broader post-compromise operations. The tooling and workflow described point to a flexible access-and-surveillance campaign designed to establish footholds, collect system intelligence, and enable additional malicious actions on victim networks.
Aug 15, 2026
PhantomStealer v3.5.0 was deployed in multiple phishing campaigns using invoice, RFQ, maritime, and industrial lures delivered as heavily obfuscated JavaScript droppers. Across the observed samples, the malware followed a consistent multi-stage chain: Windows Script Host launched PowerShell, decrypted additional payloads, reflectively loaded .NET components, and hollowed the signed Microsoft binary `Aspnet_compiler.exe` to run the final infostealer. Researchers tied the activity to the PhantomStealer malware-as-a-service ecosystem advertised via `phantomsoftwares.site` and the Telegram identity **Oldphantomoftheopera**, with builder-generated samples showing per-build customization but a stable framework, anti-analysis logic, and optional persistence. The payloads stole browser credentials, cookies, credit cards, email and messaging data, Wi-Fi passwords, screenshots, keystrokes, and cryptocurrency wallet information, while some builds also enabled a crypto clipper that replaced wallet addresses across multiple chains. The campaigns abused legitimate but compromised infrastructure for both delivery and exfiltration, including a Portuguese theater website hosting encrypted PowerShell stages, a Chilean mail server and a Malaysian business email account used as SMTP relays, and Romanian FTP hosting used by another PhantomStealer build. Exfiltration varied by sample—SMTP to attacker mailboxes at `graceishere.tech`, Telegram Bot API, Discord, or FTP—but infrastructure overlap repeatedly linked the deployments back to the same MaaS operation, and one report also connected a PhantomStealer FTP campaign to related AgentTesla activity through shared submissions and tooling. The targeting and lure themes indicate a focus on procurement, shipping, maritime, industrial, and accounts receivable personnel, while the repeated use of compromised SMB hosting and mail systems suggests operators favored hijacked third-party services over dedicated attacker-owned infrastructure.
Jun 29, 2026
Cato CTRL researchers reported an active phishing campaign targeting organizations in Brazil that delivers the legitimate **NinjaOne** remote monitoring and management agent instead of conventional malware. The operation uses Portuguese-language lures tied to fiscal records, supplier documents, complaint workflows, and secure file delivery, with victims routed through `googleusercontent` redirection chains to fake business portals. Once installed, the signed NinjaOne agent is configured for attacker-controlled access, giving the operators persistent, administrator-like remote control while bypassing many traditional malware detections. The campaign was built to evade both users and defenders, using geofencing to Brazilian IP space, browser fingerprinting, sandbox and automation detection, honeypot checks, hidden iframes, and human-interaction validation before serving payloads. Researchers said at least one organization in the chemicals and advanced materials sector was targeted, and they expanded tracking by pivoting on a reused wallpaper image across attacker domains. Parts of the infrastructure were reported to Cloudflare, but some remained accessible in early June, while overlaps with infrastructure previously linked to **Venon RAT** were observed but remain unconfirmed.
Jun 29, 2026