Phantom Enigma Uses Browser Manipulation to Install Credential-Stealing Extensions

Dec 18, 2025 · Original article ↗

Summary

Positive Technologies details Phantom Enigma’s updated phishing campaigns, which target Brazilian users with credential-stealing browser extensions and organizations with RMM tools, including Syncro. Attackers manipulate browser windows to install extensions.

Key points

Phishing invoice emails link victims to BAT or VBS scripts that download and run MSI installers.
EnigmaUiLauncher manipulates browser windows and uses Chrome DevTools Protocol commands to install malicious extensions outside browser stores.
The EnigmaBanker extension targets Brazilian banking credentials and captures user identifiers; attackers also check browser history for Brazilian banking sites.
Attacks on organizations use remote management tools including PDQ Connect, Mesh Agent, ScreenConnect, and Syncro RMM.
The attackers added a mouse-click blocker and use scheduled tasks, while shifting away from hosting extensions in the Chrome Web Store.
From September to November 2025, the researchers identified about 5,390 initial-payload downloads and roughly 143 installer downloads; they also found around 15 files linked to attacks on organizations.
The group’s infrastructure includes payload servers, command-and-control domains, and monitoring panels; server-side checks restrict some payload delivery to users in Brazil.

Article Details

Attack Vectors: Phishing invoice emails link users to malicious BAT or VBS scripts, which download and execute an MSI installer.
The installer runs PowerShell scripts that install the EnigmaBanker browser extension; EnigmaUiLauncher manipulates browser windows and uses the Chrome DevTools Protocol to import the extension.
The extension captures banking credentials and user identifiers entered on targeted banking pages and sends the data to attacker infrastructure.
Phishing emails targeting organizations link to installers for PDQ Connect, Mesh Agent, ScreenConnect, or Syncro RMM, which provide attackers remote access.
The BAT script downloads and extracts a password-protected payload archive from attacker-controlled loader endpoints.
Defensive Notes: The article reports that existing antivirus solutions were fairly effective at blocking the attackers' scripts, contributing to fewer installer downloads than initial-payload downloads.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bancopatrimonial[.]com`	Domain observed serving payload downloads from the malicious server infrastructure.
DOMAIN	`datasyncpanel[.]online`	Domain identified by the researchers as malicious infrastructure associated with the attacker panels.
DOMAIN	`novoservidor2026[.]com`	C2 and logging infrastructure for EnigmaUiLauncher; also identified among the malicious domains.
DOMAIN	`securepainelx[.]com`	Domain identified by the researchers as malicious infrastructure associated with the attacker panels.
DOMAIN	`sistemacloudx[.]com`	Domain identified by the researchers as malicious infrastructure associated with the attacker panels.
IPV4	`159[.]183[.]229[.]140`	Source IP address used to send phishing messages.
IPV4	`168[.]245[.]108[.]233`	Source IP address used to send phishing messages.
IPV4	`168[.]245[.]12[.]100`	Source IP address used to send phishing messages.
IPV4	`198[.]37[.]159[.]134`	Source IP address used to send phishing messages.
MD5	`077ce8f9fae6a4d3f8d9972c6a0fa684`	Checksum identified in the metadata for the malicious installer archive.
URL	`hxxp[:]//systemcloud26[.]com/`	Malicious server URL displaying the login panel used to identify related attacker infrastructure.
URL	`hxxps[:]//atual2025[.]com/getloader[.]php`	Attacker-controlled payload-loader URL used by the BAT script.
URL	`hxxps[:]//notifica-modulo[.]com/getloader[.]php`	Attacker-controlled payload-loader URL used by the BAT script.
URL	`hxxps[:]//webrelayapi[.]online/getloader[.]php`	Attacker-controlled payload-loader URL used by the BAT script.