PhantomEnigma is a modular backdoor built on Inno Setup and Node.js, hidden inside patched Electron applications like Boostnote. It collects system information, creates persistent machine IDs, checks for commands every 180 seconds, executes JavaScript via eval(), and downloads executable payloads. Its rotating C2 infrastructure and modular design make detection and containment difficult.