Brazil: PhantomEnigma and Banana RAT target banks

More than 20 Brazilian government websites were hijacked and turned into malware distribution channels in the PhantomEnigma campaign uncovered by ANY.RUN, while Trend Micro researchers separately exposed Banana RAT, a banking trojan identified as SHADOW-WATER-063, aimed at stealing banking credentials and sessions in Brazil.

What did PhantomEnigma do with Brazilian government domains?

More than 20 Brazilian government websites were hijacked and turned into malware distribution channels in the PhantomEnigma campaign uncovered by ANY.RUN. The finding was echoed by The Hacker News and summarized by AllSec.sh and Pendergrass Consulting, which place it within a broader pattern of government-domain abuse across more than 20 countries.

In Brazil, the cited sources say the campaign targets banking organizations and public agencies. HackRead added that PhantomEnigma abuses Brazilian government domains and trusted email channels to go after banks specifically, using .gov.br links and what it describes as trusted email to slip past security controls. So far, the sources reviewed do not attribute the operation to any APT group or state actor.

What is Banana RAT and what can it do against banks?

Separately, Igor Urraza's technical blog reports that Trend Micro researchers disclosed the full operation of a banking trojan called Banana RAT, identified as SHADOW-WATER-063. The malware uses fileless execution through PowerShell, layered obfuscation, and remote-control capabilities to steal credentials and manipulate banking sessions.

Those capabilities include tampering with Pix QR code payments, a function that is especially relevant to Brazil's financial ecosystem. According to Urraza's technical summary, Banana RAT appears aimed at enabling financial fraud directed at Brazilian banks, although the text does not name specific institutions or confirm any identified victims.

What do these two campaigns show together in Brazil?

The overlap between a campaign that repurposes .gov.br infrastructure to deliver malware and a banking trojan focused on sessions and Pix payments points to broader pressure on Brazil's financial sector and public institutions, but the available sources still do not provide a consolidated public attribution for PhantomEnigma or Banana RAT.