Hackers Hijack 20+ Government Websites to Deliver Malware Through Trusted Links

Cybersecuritynews •Guru Baran • July 21, 2026

An active malware campaign, dubbed PhantomEnigma, that abuses compromised Brazilian government infrastructure to distribute malicious payloads while evading detection. The operation has hijacked at least 20 official “.gov.br” municipal and police portals, using them as trusted delivery points for malware targeting banking and public-sector organizations. Attackers gained access to legitimate government mailboxes, allowing phishing emails […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PhantomEnigma Campaign Hijacks Brazilian Gov Websites for Malware Delivery The PhantomEnigma malware campaign has compromised over 20 Brazilian government websites, using them to deliver malware targeting banking and public-sector organizations. Attackers exploited legitimate government email accounts to send phishing emails with malicious payloads, leveraging trusted '.gov.br' links to evade detection. The operation has been active since January 2026, with various attack vectors including modular Node.js backdoors and PDF documents. Analysts report ongoing activity, with significant peaks in March and May. The campaign poses severe risks, including financial loss and data exposure, particularly affecting institutions like Banco do Brasil. Mitigation guidance has been provided for security leaders to address this threat. 2 sources 72

Extracted Entities

Hackers Hijack 20+ Government Websites to Deliver Malware Through Trusted Links

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Domains (1)

Industries (1)

MITRE ATT&CK (1)