More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN,…
PhantomEnigma is an active malware campaign that evolved from a browser-extension banker into a modular Inno/Node.js backdoor. It uses compromised Brazilian government…
PhantomEnigma is a modular backdoor built on Inno Setup and Node.js, hidden inside patched Electron applications like Boostnote. It collects system information,…
Boostnote, a legitimate open-source note-taking application, was patched by attackers to load a malicious index.js backdoor as part of the PhantomEnigma infection…