Operation Phantom Enigma: Malicious Browser Extensions Targeting Brazil in 2025

Introduction: Brazil Under Cyber Siege in 2025

In early 2025, a stealthy cyberattack campaign named Operation Phantom Enigma has emerged, targeting Brazilian internet users with remarkable precision. Cybersecurity experts have uncovered a sophisticated method of phishing that installs malicious browser extensions on Chromium-based browsers like Chrome, Edge, and Brave. These extensions are designed to hijack user authentication data, especially targeting banking credentials. What’s striking is the use of compromised corporate servers to send out phishing emails, making them appear trustworthy and significantly boosting success rates.

This campaign is not isolated. It spans across several countries and uses multi-stage malware deployment tactics, heavily relying on fake invoices and malicious scripts. The final payload? Browser add-ons that interact directly with Brazilian banking sites, exfiltrating credentials silently. Here’s a deeper dive into this disturbing development.

Operation Phantom Enigma Campaign

Cybersecurity researchers have traced an ongoing campaign launched in early 2025, targeting Brazilian users through compromised business email servers. The attackers used deceptive phishing emails disguised as legitimate invoices. These emails either link to a downloadable file or include malicious attachments, initiating a complex, multi-layered infection process.

The attack begins with a batch file that downloads a PowerShell script. This script checks for virtualization environments and software like Diebold Warsaw, commonly used in Brazilian banking for secure online transactions. If the environment passes, it disables User Account Control (UAC), sets the malware to persist after reboot, and connects with a remote server for command execution.

Commands include:

PING – Heartbeat signal

DISCONNECT – Kill process

REMOVEKL – Uninstall malware

CHECAEXT – Browser extension check

START_SCREEN – Force-install malicious extensions

The malicious extensions were downloaded over 700 times from countries including Brazil, Colombia, Czech Republic, Mexico, Russia, and Vietnam, affecting at least 70 companies. Though they’ve since been removed from the Chrome Web Store, they were specifically designed to target users accessing Banco do Brasil. These extensions steal authentication tokens and inject JavaScript that interacts with the attacker’s server.

Interestingly, some command keywords—WARTEN, SCHLIEBEN_WARTEN, and CODE_ZUM_LESEN—are in German, possibly pointing to the origin of the attackers or borrowed code. Instead of browser extensions, some versions of the attack use Windows Installer or Inno Setup to deliver remote access tools like MeshCentral Agent or PDQ Connect Agent.

Further investigation found an open directory containing auxiliary scripts and links referencing EnigmaCyberSecurity, hinting at the operation’s broader infrastructure. Despite the varied techniques, the end goal remains unchanged: to quietly steal login credentials and banking authentication data from unsuspecting Brazilian users.

What Undercode Say: 💻 Deconstructing the Attack Layers

Targeting Methods and Scope

The campaign’s reach across Brazil and other nations shows a sophisticated understanding of both geography and psychology. By using compromised servers from legitimate companies, attackers weaponized trust—one of the most difficult elements to defend in cybersecurity. This approach indicates a high level of strategic planning and a calculated deployment to maximize effectiveness while minimizing early detection.

Exploitation of Local Banking Security

One standout detail is the script’s check for the Diebold Warsaw plugin, a security measure used in Brazilian banking. This shows attackers specifically customized their malware to target local security frameworks, suggesting they had extensive prior knowledge of Brazil’s banking infrastructure. It’s a localized attack, but with international tools and reach.

Evasion and Persistence Techniques

The use of PowerShell, UAC bypass, and persistence through scheduled tasks are classic red flags in malware campaigns. However, embedding these within browser extensions and using system-level scripting elevates the threat. These tactics not only prolong the life of the malware but also reduce the chances of detection by basic antivirus tools.

Command-and-Control Versatility

The command structure gives attackers full control over the infected system—from simply checking if the extension is active to deploying visual deceits like fake loading screens or QR codes to manipulate users. The use of German words in commands adds a layer of mystery—either hinting at code reuse from another region or a false-flag tactic to confuse attribution.

Implications for Businesses and Individuals

The campaign’s dual-pronged nature—targeting both individual users and companies—raises the stakes. Businesses can become unknowing conduits for phishing attacks, compromising their reputation and client trust. Individuals, meanwhile, face financial losses and identity theft. The infection chain demonstrates a calculated balance between stealth and effectiveness.

✅ Fact Checker Results

✅ Verified: Malicious extensions were removed from the Chrome Web Store.
✅ Verified: Diebold Warsaw is a known security plugin used by Brazilian banks.
❌ False Alarm: No confirmed evidence yet that the attackers are German—language use may be deception.

🔮 Prediction: Future Cyber Threat Trends in Latin America

Operation Phantom Enigma is likely just the beginning. Given its early 2025 onset and relatively high success, similar campaigns may escalate throughout Latin America. We predict:

Increased use of localized malware targeting region-specific banking tools.
Greater adoption of multi-stage scripting to evade sandbox analysis.
Broader deployment of remote access tools as fallback payloads when browser extension delivery fails.

Banks and institutions in Brazil and neighboring countries must adapt quickly, investing in stronger endpoint detection and user education. The tactics seen here are evolving—and so must our defenses.

References:

Reported By: thehackernews.com
Extra Source Hub:
https://www.reddit.com
Wikipedia
Undercode AI

Image Source:

Unsplash
Undercode AI DI v2

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram