Operation Phantom Enigma

Authors: Klimentiy Galkin, Threat Intelligence Specialist at the Positive Technologies Expert Security Center

• A malicious campaign discovered by Positive Technologies specialists is primarily targeting residents of Brazil. Attacks have been detected since the beginning of 2025.
• Some of the phishing emails were sent from the servers of compromised companies, increasing the chances of a successful attack.
• The attackers used a malicious extension for Google Chrome, Microsoft Edge, and Brave browsers, as well as Mesh Agent and PDQ Connect Agent.
• The total number of the malicious extension downloads has exceeded 700. Among the victims, in addition to users from Brazil, were companies from Colombia, Czech Republic, Mexico, Russia, Vietnam, and other countries.

At the beginning of 2025, threat intelligence specialists of the Positive Technologies Security Expert Center discovered a malicious email offering to download a file from a suspicious website. The identified attack chain leads to the installation of a malicious extension for the Google Chrome browser, targeting users in Brazil. 

During the investigation, files were found in an open directory belonging to the attackers. This allowed us to identify another variation of the attack involving Mesh Agent or PDQ Connect Agent instead of a malicious browser extension. There were also auxiliary scripts containing links with parameters that included the EnigmaCyberSecurity identifier, which is how the campaign got its name.

In the initial version of the attack chain, phishing emails disguised as invoices are used to distribute malware. These emails encourage recipients to download a file from the provided link or open a malicious attachment contained within an archive.

At this stage, several file formats may be used, which will be discussed further.

The contents of the BAT script are listed below. Its main task is to download and execute a malicious PowerShell script.

Fragment of the executed PowerShell script:

The functionality of the PowerShell script includes:

• Checking for virtualization
• Checking for Warsaw Technology. This service is developed by GAS Tecnologia along with GBPlugin to protect banking transactions in Brazilian banks. Therefore, the attack mainly targets users in Brazil.
• As part of the persistence mechanism, a registry value named 'PWSecurity' is created under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, pointing to the BAT script previously relocated to the %APPDATA% directory (see Figure 3)..

• Disabling UAC by setting the registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA.
• Connecting to C2 142.54.185.178, receiving and processing commands (Figure 4).

The main section of the script processes commands from the server in an infinite loop. The list of commands and their descriptions is provided below:

The MSI file is used by attackers to deliver and install the malicious extension for three browsers: Microsoft Edge, Google Chrome, and Brave. The execution sequence within the installer is shown in Figure 5. It includes two main actions: viewer.exe and LaunchExeWithDirectory.

First, unificado.bat is launched with the following command: /EnforcedRunAsAdmin /HideWindow "[#unificado.bat]". The unificado.bat file looks as follows:

The script collects basic information about the victim's system and sends it to the C2 server enota.clientepj.com with the following parameters:

• Date and time
• Public IP address
• Hostname
• Location
• Information about the presence of Warsaw Technology
• Status dependent on service availability

As you can see, further work requires Warsaw Technology. If this service exists in the victim's system, the script completes successfully and the next steps are initiated.

The LaunchExeWithDirectory event executes obfuscated JavaScript code from the event.js file. The file can be found inside the installer (Figure 7). The fragment of JavaScript code after deobfuscation is shown below:

The algorithm of this Powershell script differs from the previously analyzed one in the following ways:

• No need to install the extension from the Chrome Web Store, as it is already located next to the .js file.
• Persistence is gained by searching for and modifying LNK files pointing to browsers in user folders. The--load-extension=<extension-path> parameter is added to them, where extension-path is the path to the extension's source code specified within the script. In this case: C:\programdata\microsoft\TIMEDATE\.

Unlike MSI, the Inno Setup installer runs a PowerShell script described above in the section about the BAT file:

The extension consists of several .js files and a manifest file (Figure 9). The main code is located in the file run-back.js, while cs.js is injected into specific pages after they load, as seen in the manifest. The URL patterns in the manifest and script code indicate that they belong to Banco do Brasil.

First, let's examine run-back.js, which appears as follows after deobfuscation:

When the extension is installed, the value eindeutigeKennung (German for unique identifier) is placed in the code storage. The value is calculated as shown below:

The code contains callback functions triggered by the events onBeforeSendHeaders, onBeforeRequest, and onMessage. To interact with the C2 server, the attackers wrote several auxiliary functions. The function r(requestBody, requestMethod) whose code is provided above sends data to the server by including the unique identifier eindeutigeKennung in one of the parameters. The collected information is shown below:

Below is an example of code that sends information containing user data:

Another function s() is used to receive and process commands from the attackers' server. It is called by the onBeforeRequest and onMessage events:

The function s() is shown below:

This function interacts with cs.js (shown below):

The code of the files cs.js and s() indicates that their development is incomplete, but their potential functionality is clear. If the active tab's link contains the substring apf-apj- used in the API of Banco do Brasil, the function s() sends a request to the attackers' server at https://financial-executive.com/comando_temporario.php to receive a new command.

The attacker collects confidential user information used for authentication in a specific service (presumably Banco do Brasil). An interesting feature of the code is the use of German or Portuguese for variable names. This could indicate the attacker's location or suggest that the stealer's code was borrowed rather than written from scratch.

Alongside the attack via a browser extension, an attack using Mesh Agent malware was discovered.

The malware is distributed using the same method: a phishing email about an invoice containing an MSI file. After successful installation, the agent runs and connects to the server via the link wss://mesh.computadorpj.com/agent.ashx and https://mesh.computadorpj.com/. In addition to Mesh Agent, several samples of PDQ Connect Agent installers were found on the attackers' servers.

The RAT attack enables attackers to spread across the infected infrastructure, whereas the malicious extension attack targets only a single user device. One of the consequences of the attack for companies will be described in the section Victims.

The study identified several malicious domains and attacker servers. Thanks to a detailed study of the TLS certificates and other artifacts from the two attack chains, several network indicators were identified:

• *.computadorpj.com
• financial-executive.com
• 142.54.185.178
• clientepj.com
• ranchocentral.com

The domain computadorpj.com shares a TLS certificate with the domain nfe-fiscal.com. Both domains were located at the IP address 107.174.231.26 of the autonomous system (AS-COLOCROSSING). 

Other subdomains were partially located at the IP address 142.54.185.178 used in a PowerShell script to send commands to the victim's system.

The infrastructure can be expanded by analyzing the metadata of malicious installers (Figure 15). Searching open sources, including public sandboxes, helped identify additional network indicators for investigation, such as GitHub repositories.

The new network indicators obtained from ITW links of detected samples with similar metadata (Figure 10) are as follows:

• 18.231.162.77
• https://github.com/contaaws20251
• hamrah-tejarat.com
• servidor2025.com
• atual2025.com
• syarousi-search.com

The PowerShell scripts used to install the extension on the victim's system specify the identifier from the Chrome Web Store. The detected extension identifiers are as follows:

• nplfchpahihleeejpjmodggckakhglee
• ckkjdiimhlanonhceggkfjlmjnenpmfm
• lkpiodmpjdhhhkdhdbnncigggodgdfli

These extensions have already been removed from the store as malicious, but the change history of some of the created extensions is still available.

As mentioned earlier, the analyzed malicious campaign utilizes two attack chains: one involving a malicious extension targeting users in Brazil, and another using Mesh Agent. The second attack enables attackers to spread across the infrastructures of infected companies.

It was possible to identify the compromised organizations and one of the infection targets using data in the attackers' open directory. In the file https://enota.clientepj.com/uploads/resultados.txt, links of the type http://<victim-domain>/about.php?key=EnigmaCyberSecurity were listed. Some of the links still show activity (Figure 17, certain fields are blurred for privacy). The name of the bottommost text field translates to English as Enter the victim's email address below. Multiple email addresses can be entered at once. The source code of this page is also available in the attackers' open directory.

Therefore, the attackers require the servers of the compromised companies to send emails for infecting users in Brazil with a malicious extension.

A total of 70 unique victim companies were identified based on the links. The extension was downloaded 722 times from the Chrome Web Store. However, some of these downloads were performed by sandboxes. The geographical distribution of the victims is shown in the figure below:

The study highlights the use of rather unique techniques in Latin America, including a malicious browser extension and distribution via Windows Installer and Inno Setup installers. To increase the versatility of their attacks and maximize the number of potential victims, the attackers used two attack chains: one involving an extension and the other using Mesh Agent or other RATs.

Files in the attackers' open directory indicate that infecting companies was necessary for discreetly distributing emails on their behalf. However, the main focus of the attacks remained on regular Brazilian users. The attackers' goal is to steal authentication data from the victims' bank accounts. We will continue monitoring this malicious activity and will promptly notify you of any new large-scale attacks.