{"id":290312,"date":"2026-07-16T07:58:00","date_gmt":"2026-07-16T11:58:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/07\/16\/20-hijacked-government-websites-became-an-attack-channel\/"},"modified":"2026-07-16T14:50:11","modified_gmt":"2026-07-16T18:50:11","slug":"20-hijacked-government-websites-became-an-attack-channel","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/07\/16\/20-hijacked-government-websites-became-an-attack-channel\/","title":{"rendered":"20+ Hijacked Government Websites Became\u2028an Attack Channel"},"content":{"rendered":"

20+ Hijacked Government Websites Became\u2028an Attack Channel<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/07\/20-hijacked-government-websites.html<\/a><\/p>\n

Publish Date: 2026-07-16 07:58:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

\ue804The Hacker News<\/span>\ue802Jul 16, 2026<\/span><\/span>Malware \/ Endpoint Security<\/span><\/p>\n

More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions.<\/p>\n

The investigation revealed previously undocumented backdoor behavior, hidden infrastructure relationships, and multiple attack arms behind a campaign putting banks and public agencies at risk.<\/p>\n

By connecting hundreds of seemingly unrelated sandbox sessions, ANY.RUN researchers exposed the operation\u2019s broader scope and showed how trusted .gov.br links and authenticated emails helped the activity remain hidden.<\/p>\n

For the complete technical analysis, infrastructure details, indicators, and detection guidance, read the full PhantomEnigma investigation report<\/p>\n

Trusted Government Infrastructure Became the Lure<\/h2>\n

The attack began with fake police-themed documents presented as official \u201cOf\u00edcio Pol\u00edcia Civil\u201d or \u201cProcura\u00e7\u00e3o Digital\u201d notices. Some contained QR codes, while others directed recipients to links designed to look like legitimate government resources.<\/p>\n\n\n\n
\"\"<\/td>\n<\/tr>\n
Fake police-themed document analyzed inside ANY.RUN sandbox for full visibility into PhantomEnigma attack<\/td>\n<\/tr>\n<\/table>\n

In several cases, the emails were sent through compromised mailboxes and passed SPF, DKIM, and DMARC checks. That gave the messages a stronger appearance of legitimacy than ordinary spoofed phishing emails.<\/p>\n

Victims were then redirected through compromised .gov.br hosts or police-themed lookalike domains before reaching the malicious installer. The government systems were used as trusted delivery infrastructure, not necessarily as the final targets of the campaign.<\/p>\n

Observed Government Hosts<\/h3>\n

Among the compromised systems observed during the investigation were timon.ma.gov[.]br, loginam.sesp.es.gov[.]br (state public security), aplicacao.cbm.mt.gov[.]br (fire department), prodoc.ap.gov[.]br,…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

20+ Hijacked Government Websites Became\u2028an Attack Channel https:\/\/thehackernews.com\/2026\/07\/20-hijacked-government-websites.html Publish Date: 2026-07-16 07:58:00 Source Domain: thehackernews.com…<\/p>\n","protected":false},"author":1,"featured_media":290313,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgs_Ix6AmdT0f-NuPj2BLNRcSaOhWHf5pPdDuwR0eykvHCnOmoHUhq5Z2axM2GJX9gX5A3FlesfKuynGTsj012HNIJZURuZ8S7uCfa7_cSXIZDWC1donHjiQbkNr3jNLSq8B2PGpUG24fddwOaG2POjEQuvlrVEnp3yPa1F3tV2fpYDVQHEsaIHbnShUuQ\/s1600\/hacked.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[35,32,25],"class_list":["post-290312","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-hacker","tag-malware","tag-phishing"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/290312"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=290312"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/290312\/revisions"}],"predecessor-version":[{"id":290314,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/290312\/revisions\/290314"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/290313"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=290312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=290312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=290312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}