Hidden Infrastructure Exposed: ANY.RUN Reveals Hijacked Gov Websites Delivering Malware 

**Executive summary:** ANY.RUN investigators uncovered PhantomEnigma, a Brazil-focused cybercrime campaign abusing compromised .gov.br sites and compromised mailboxes to deliver a Delphi/Inno Setup installer that deploys a patched Electron/Boostnote Node.js backdoor for credential theft and modular payload delivery; the report includes static deobfuscation, live re-detonation (confirming POST /nbw/ to zsxocjarsate.com), 231 related sandbox sessions, detailed IOCs (domains, IPs, hashes), and actionable detection and mitigation guidance.