Executive Summary
The PhantomEnigma campaign represents a significant threat to the Brazilian financial and public sectors, utilizing over 20 compromised municipal and police websites (.gov.br) to distribute malware. Identified in mid-2026, this operation employs a sophisticated build chain that begins with a Delphi-compiled Inno Setup installer. This installer deploys a modified Electron application containing an obfuscated Node.js backdoor capable of executing remote commands and downloading additional payloads.
The threat actor has evolved from simple browser extensions to high-capability modular backdoors that can bypass standard email security checks like SPF, DKIM, and DMARC by using hijacked official mailboxes. The primary goal appears to be the theft of banking credentials, specifically targeting institutions such as Banco do Brasil, while leveraging legitimate government domains to build trust and evade initial security screenings.