When Trusted Gov Infrastructure Becomes an Attack Channel: PhantomEnigma Puts Banks at Risk 

ANY.RUN analyzed the PhantomEnigma campaign that abused compromised Brazilian government websites and phishing to deliver installers (Inno Setup/MSI) and a modular Node.js backdoor (index.js). The campaign focuses on credential theft against banking organizations, enabling fraud, unauthorized access, data exposure, and persistent footholds; ANY.RUN recommends behavioral sandboxing and continuous monitoring to reduce detection delays and business impact.