PhantomEnigma is an active malware campaign that evolved from a browser-extension banker into a modular Inno/Node.js backdoor. It uses compromised Brazilian government websites and authenticated emails to deliver malicious payloads, targeting banks and public agencies. The backdoor collects system data, establishes persistence, and can execute JavaScript or deliver additional malware.