PhantomEnigma

Key Takeaways

• Abuse of Trusted Government Systems: According to ANY.RUN, PhantomEnigma utilizes at least 20 hijacked .gov.br municipal and police portals to distribute malware. This allows phishing emails to pass standard authentication checks and reach victims with a high level of perceived trust.
• Durable Build-Chain Fingerprints: While C2 domains and IP addresses rotate weekly, the operation relies on a consistent Delphi-compiled Inno Setup installer carrying an embedded Node.js or Electron application. This build-chain combination allows for 100% recall across analyzed clusters.
• Coordinated Multi-Arm Operation: The campaign includes the "Ofício-PC" quishing (QR-code phishing) arm, which uses fake police PDF documents to trigger PowerShell commands. Shared infrastructure between this arm and the Node.js backdoor arm confirms they belong to the same operator.
• High Business and Financial Risk: The operation specifically targets banking credentials (notably Banco do Brasil) and installs Remote Monitoring and Management (RMM) tools like Syncro, PDQ Connect, and MeshAgent to maintain persistent access to corporate infrastructure.

A compromised PhantomEnigma website delivering malware

What is PhantomEnigma?

PhantomEnigma is a mature, Brazil-focused crimeware operation that provides a turnkey solution for financial fraud and infrastructure expansion. It operates as a coordinated campaign that combines modular malware, frequently rotated infrastructure, and the exploitation of trusted government hosting to evade traditional security perimeters.

Read extended analysis of PhantomEnigma attacks on ANY.RUN’s Cybersecurity blog

The operation has significantly evolved in technical complexity. Originally documented in 2025 as a browser-extension banker (Generation A), it has transitioned into a sophisticated modular Node.js backdoor (Generation B). A core tactic involves patching legitimate applications, such as the Boostnote note-taking app, and injecting a malicious index.js file into the Electron runtime. This allows the malware to masquerade as legitimate software while performing reconnaissance and executing remote tasks.

A timeline of PhantomEnigma attacks

PhantomEnigma pursues two distinct attack paths:

• Individual Targets: Stealing authentication tokens and credentials for Brazilian online banking systems to facilitate direct financial theft.
• Organizational Targets: Expanding attacker infrastructure by compromising corporate email servers and installing RMM agents to establish a persistent foothold for future operations.

The operation's resilience is built into its decoupled architecture, where the delivery channel (government portals), command-and-control (C2) servers, and exfiltration endpoints are managed as separate layers. This structure ensures that the malware can continue to function even if individual components are identified and blocked.

How PhantomEnigma Threatens Businesses and Organizations

For organizations, PhantomEnigma represents a sophisticated threat that extends far beyond simple banking fraud. By infiltrating corporate environments, the group creates a foundation for long-term persistence and large-scale exploitation:

• Financial Fraud and Data Theft: The primary objective is the theft of credentials for Brazilian banking institutions, such as Banco do Brasil. Compromised credentials enable unauthorized transactions, payment redirection, and the exposure of sensitive financial records.
• Persistent Infrastructure Control: Attacks on organizations often involve the deployment of Remote Monitoring and Management (RMM) tools, including Syncro RMM, PDQ Connect, and MeshAgent. These tools allow attackers to maintain a permanent foothold, bypass standard security alerts, and expand their reach within the victim's infrastructure.
• Evasion and Delayed Containment: One of the greatest risks is the operation's high success rate in evading automated detection. Nearly one-third of analyzed activity initially received "clean" verdicts because the malware utilizes trusted government domains and modular, delayed payloads. This "visibility gap" delays investigation and gives the operation more time to spread undetected.

Victimology: Who Is Most Vulnerable?

The targeting profile of PhantomEnigma is heavily specialized, with a clear focus on the financial and public sectors within a specific geographic region:

Brazil remains the strongest targeting signal, representing 60.3% of the .gov.br delivery cluster and 46% of the operator C2 cohort observed in ANY.RUN data.

The group’s primary goal is the compromise of users at Brazilian banks. This includes both individual account holders and employees of financial institutions whose corporate systems are targeted to facilitate larger fraud operations.

While municipal and police portals in Brazil are the most frequent delivery channels, they are often the compromised middleman rather than the final victim. At least 20 different government portals have been identified as hosting malicious payloads.

Activity has been observed targeting consulting firms, logistics companies, retail, chemical, and IT sectors. The common denominator is often the use of legitimate corporate email servers to host phishing lures, exploiting the existing trust between business partners.

How Does PhantomEnigma Malware Function? (The Sandbox Analysis)

Detonating a PhantomEnigma sample in the ANY.RUN Interactive Sandbox provides a transparent, step-by-step look at how this modular crimeware operation functions.

View analysis of a PhantomEnigma attack inside ANY.RUN’s Interactive Sandbox

By moving beyond static analysis, defenders can observe the following stages of the attack in real-time:

Stage 1: The Initial Lure and Trusted Hosting

The infection chain begins with a spoofed email, often appearing as an official "Polícia Civil" summons or a "Procuração Digital" (Digital Power of Attorney) notary notice. To bypass email security filters, the link provided in the email leads to a compromised Brazilian government host (.gov.br) or a police-themed typosquat .com domain.

A fake email sent as part of a PhantomEnigma campaign

Stage 2: The Delphi/Inno Setup Installer

Upon clicking the link, the host serves a Delphi-compiled Inno Setup installer, such as Procuracao_Digital.exe. When executed in the sandbox, this installer silently unpacks a patched Electron/Node.js-based application, often masquerading as the legitimate note-taking app Boostnote.

A compromised PhantomEnigma website delivering malware

Stage 3: Backdoor Activation and Masquerading

The malicious logic is contained within a file named index.js hidden inside the application's resources. As the Electron host loads this script, the sandbox reveals several critical behaviors:

• Self-Deobfuscation: The script reverses multiple layers of obfuscation to reveal its command-and-control (C2) logic.
• Reconnaissance: The malware uses child_process to gather system information, including the computer name, username, and machine ID.
• Masquerading: The decoy binary (originally Boost Note.exe) is often renamed to generic titles like Grape.exe or placed in installation directories with "word-salad" names such as ProSoftxUltraToolator to avoid detection.

PhantomEnigma backdoor code

Stage 4: Real-Time Beaconing and C2 Communication

ANY.RUN analysts have identified at least two parallel beacon generations used by the backdoor:

• Generation 1: Uses a GET request to a /laravel.php endpoint, with victim data encoded in the URL parameters.
• Generation 2: Uses a POST request to an /nbw/ endpoint with a JSON-formatted body containing the machine ID and campaign tags. The backdoor is programmed to check for new commands from the C2 server every 180 seconds.

Stage 5: Modular Second-Stage Delivery

Once a connection is established, the server can return tasks for the infected machine to execute:

• In-Process Execution: The server sends JavaScript code that the backdoor runs directly using the eval() function.
• Child Process Deployment: The C2 can transmit separate executable files to be dropped and launched. This modularity allows the attacker to deliver the final payload, such as a stealer, loader, or Remote Monitoring and Management (RMM) tool like Syncro or MeshAgent.

Stage 6: Persistence and Infrastructure Rotation

To ensure a long-term foothold, the malware establishes persistence through Registry Run keys or the setLoginItemSettings function. Analysts can observe that while the malware's code remains a durable fingerprint, the C2 infrastructure rotates weekly, moving between different Cloudflare-fronted domains and compromised government portals to stay ahead of static blocklists.

How Businesses Can Use ANY.RUN’s Threat Intelligence Against PhantomEnigma

Because PhantomEnigma rotates its command-and-control (C2) infrastructure weekly and utilizes compromised legitimate government portals, static blocklists often fail to provide adequate protection. To counter this, security teams can leverage ANY.RUN’s Threat Intelligence to identify the underlying "build-chain" fingerprints that remain stable even as domains change.

Threat Intelligence Lookup allows analysts to pivot from a single suspicious file to the entire cluster of related activity by searching for the malware's technical DNA rather than just its current address.

TI Lookup displays the latest threat intel on PhantomEnigma attacks

Security teams can identify related activity by searching for specific build-chain tags: domainName:”.gov.br” AND threatName:”nodejs” AND threatName:”inno*”.

This way, SOC teams can track the latest changes in PhantomEnigma’s campaigns and always have actionable intel to enrich and update their defenses.

TI Feeds deliver fresh IOCs to your SIEM/SOAR for proactive threat blocking

For organizations looking to automate their proactive defense, ANY.RUN’s Threat Intelligence Feeds provide a real-time stream of validated indicators based on the latest sandbox investigations by 15K SOCs and 600K analysts. The feeds deliver the most recent C2 domains, IP addresses, and URLs, directly into SIEM, SOAR, and EDR platforms. By integrating these feeds, teams can block emerging malicious infrastructure.

ANY.RUN’s TI Report on PhantomEnigma reveals all domains used by attackers

ANY.RUN also published a dedicated Threat Intelligence (TI) Report on the PhantomEnigma operation. The report presents a deep-dive investigation by ANY.RUN’s dedicated team of TI experts who meticulously track active attacks on businesses. The TI Report provides curated TTPs (Tactics, Techniques, and Procedures) and IOCs, offering security leaders a "playbook" for proactive defense.

By combining the behavioral visibility of the Interactive Sandbox with Threat Intelligence, businesses can effectively track the evolution of PhantomEnigma and secure their infrastructure against trust-based evasion tactics.

Conclusion

PhantomEnigma represents a growing trend of "trust-based" evasion, where attackers bypass traditional security perimeters by hiding behind compromised government infrastructure and legitimate corporate email accounts. The operation remains difficult to track because its infrastructure rotates faster than its code. Reducing business risk requires a transition to behavioral identity analytics and proactive threat hunting that connects fragmented indicators.

Frequently Asked Questions: PhantomEnigma

1. What is PhantomEnigma?

PhantomEnigma is a sophisticated crimeware operation targeting Brazilian banking organizations and the public sector. It primarily utilizes a modular Node.js backdoor to steal credentials and maintain persistent access to corporate cloud environments.

2. How does PhantomEnigma evade email security?

The group hijacks legitimate .gov.br municipal and police portals to host its malware. Because the delivery comes from trusted government infrastructure, phishing emails often pass SPF, DKIM, and DMARC checks, reaching victims with a high level of perceived legitimacy.

3. What are the key technical indicators of a PhantomEnigma infection?

The most reliable signal is the build chain: a Delphi-compiled Inno Setup installer that silently deploys a patched Electron application (often masquerading as Boostnote). Technically, the malware is identified by network beacons to /laravel.php or /nbw/ endpoints.

4. Why do many PhantomEnigma samples receive "clean" verdicts?

Attackers use modular, delayed payloads and trusted infrastructure to appear benign to automated scanners. Many versions also perform reconnaissance and check for specific banking plugins (like Warsaw Technology) before activating their malicious logic.

5. How can organizations mitigate this threat?

To mitigate this threat, companies need to integrate interactive sandboxing and proactive threat intelligence to expose the modular logic of malware that often evades traditional automated scanners. By using solutions like TI Lookup and TI Feeds, organizations can identify stable build-chain fingerprints and block rotating infrastructure in real-time. Furthermore, leveraging expert-led TI Reports allows security teams to connect fragmented indicators and significantly shorten the time required for threat containment.