Hackers Hijack Brazilian Government Websites to Game Search Rankings and Host Phishing Pages

Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organisations. The tradecraft points to a Chinese-speaking cybercrime group linked to Earth Berberoka, an actor first documented targeting gambling sites across Asia. Once inside a victim, the group deploys a broad Linux toolkit that includes a custom downloader, several backdoors and familiar offensive utilities. Most of it is heavily obfuscated to slow analysis and evade detection.

The attackers install custom Apache modules that quietly proxy visitors to a large set of phishing pages. Many of those pages sit on Brazilian government domains that appear to have been compromised and repurposed without their owners' knowledge. The researchers say the likely goal is search engine manipulation at scale: by borrowing the reputation of trusted domains, the operators push their own content up the rankings and capture the traffic that follows. The same actor also runs a second phishing network aimed at Vietnamese victims. Some pages impersonate app-download sites such as Google Play, the Microsoft Store and Amazon, which leaves the operators one step from delivering malware directly.

Check Point has not observed how the group gains initial access. However, an exposed open directory on one of their servers held a Go-based tool the group calls "cam-agent", which bundles many reconnaissance and scanning plugins built on known open-source pentesting tools. Together they look like a complete pipeline for mapping the internet-facing systems of potential targets.