Researchers say compromised Brazilian government and education websites were altered with malicious Apache modules that silently rerouted visitors to attacker-controlled pages. The fake pages impersonated trusted app stores (Google Play, Microsoft Store, Amazon) to funnel people toward online gambling and sports betting sites while still appearing to come from the real government domain.
Researchers found that a cybercrime cluster installed malicious Apache modules directly on compromised web servers belonging to Brazilian government and educational institutions. These modules acted as a reverse proxy, silently redirecting visitors to attacker-controlled pages while the browser's address bar continued to show the legitimate government domain. The redirected pages impersonated trusted app stores, including Google Play, Microsoft Store, and Amazon, and used that false credibility to funnel visitors toward online gambling and sports betting sites. Security headers were stripped from the compromised servers, which allowed the injected content to run without the usual browser protections kicking in.
This attack worked because it exploited the trust users place in domain names rather than page content. A visitor arriving at a familiar .gov.br address had no easy way to tell that the server itself had been altered at the infrastructure level. Because the reverse-proxy technique preserved the original domain in the URL, standard visual cues that people rely on, such as checking for a legitimate web address, offered no protection. Researchers assessed the likely purpose as large-scale SEO manipulation, leveraging the high reputation of government domains to boost the visibility of the betting-related content.
Organizations and individuals should be trained to judge trust based on page content and context, not solely on the domain shown in the address bar. If a familiar site suddenly behaves unexpectedly, the safest response is to stop interacting with it and report the anomaly rather than assume the domain guarantees legitimacy. Security teams handling compromised .gov.br or .jus.br infrastructure should avoid blanket blocking of these domains, since doing so would disrupt access to legitimate public services; instead, case-by-case remediation is recommended. Communications and public affairs teams may also need to issue user advisories if a government-run site is confirmed to be compromised, helping the public recognize and avoid the redirected pages while the underlying issue is addressed.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They installed malicious Apache modules on compromised Brazilian government and education web servers that reverse-proxied visitors to attacker-controlled pages while traffic still appeared to come from the legitimate domain.
The redirected pages impersonated trusted app stores including Google Play, Microsoft Store, and Amazon, then pushed visitors toward online gambling and sports betting sites.
Because the browser still shows the trusted government domain even though the page content and behavior no longer match what the user expected, and security headers were stripped to let the injected content run.
No, researchers cautioned against broadly blocking compromised .gov.br domains since that would disrupt access to legitimate government resources, and recommended handling compromised hosts separately from attacker infrastructure.
You open a Brazilian government site, but suddenly you’re staring at a “Google Play” download page. Looks legit, right? Researchers found a group called “Gambling Goblin” slipping malicious Apache modules onto Brazilian gov and university servers, silently reverse-proxying visitors to fake Google Play, Microsoft Store, or Amazon pages that push online gambling and sports betting. Here’s the trap: the browser says .gov.br, but the page is acting like an app store or betting site. That mismatch is your red flag. The whole point is SEO and clicks, using trusted government domains to boost shady gambling pages. If a government or education site suddenly turns into an app store or betting pitch, don’t click anything, close the tab and report the exact URL to security right away.
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
Researchers described a real cybercrime operation (“StopAndProtect”) that compromised nearly 2,000 WordPress sites and used them to show fake CAPTCHA pages that trick visitors into running malicious commands. Victims can end up with malware that steals files and screenshots and, in some cases,…
Check Point Research reports a real campaign where a Chinese-speaking actor compromised Brazilian government and education websites and used them as stealthy “front doors” to redirect visitors to attacker-controlled phishing pages. The fake pages impersonate trusted app stores (Google Play,…
The article describes how attackers use QR codes in emails (“quishing”) to hide malicious links, push victims onto less-protected mobile phones, and steal credentials or MFA tokens. It also cites an FBI notice describing North Korea’s Kimsuky using QR codes in spearphishing emails targeting think…
Microsoft says Russian-linked threat actors compromised hotel and conference guest Wi‑Fi “captive portal” networks to redirect travelers to fake Microsoft 365 sign-in pages, device-code phishing, or fake update pages. The goal was to steal cloud credentials (including Entra ID device codes) and…
Russia’s FSB claims Ukrainian intelligence used a Telegram dating chatbot to deceive and psychologically pressure young Russians into sharing locations, clicking phishing links, and later carrying out arson or armed attacks. The alleged scheme started with romance-style outreach and payments via…
