PhantomEnigma Infects Organizations with Malware via Hijacked Government Websites

PhantomEnigma is a sophisticated phishing and malware campaign that leverages compromised Brazilian .gov.br portals and authentic government email accounts to distribute Delphi-built installers that unpack a patched Electron backdoor (malicious index.js). The operation targets banking and public-sector organizations to harvest credentials and deploy stealers/remote tools, uses trusted domains to evade reputation controls, rotates C2 infrastructure frequently, and has been linked across hundreds of observed sandbox sessions via a consistent build-chain fingerprint.