20+ Hijacked Government Websites Became
an Attack Channel

PhantomEnigma is an active, modular malware campaign that abused compromised Brazilian government domains and authenticated emails to deliver Inno/Node.js installers and a patched Electron/JavaScript backdoor; the backdoor can collect system data, maintain persistence, execute JavaScript, and deliver secondary payloads (stealers, loaders, RMM), posing elevated risk to banks and public-sector organizations and complicating detection due to trusted delivery infrastructure and rotating C2s.