Researchers have uncovered a campaign in which cybercriminals breached Brazilian government and education servers, turning them into a network of reverse proxies. The hijacked domains, which carry trusted .gov.br and .edu.br suffixes, are being used to serve gambling-themed phishing sites. Because the pages appear to come from legitimate government infrastructure, they are more likely to bypass security filters and trick visitors.
The attackers behind the operation are described as a Chinese-language group. Their approach leverages the reputation of the compromised domains to lend credibility to the fraudulent pages, while also making takedown efforts more complicated. The reverse-proxy setup means the actual phishing content can be hosted elsewhere, with the compromised servers acting as a gateway.
This incident highlights how trusted domain suffixes can be weaponized for phishing. Organizations operating public-facing infrastructure, especially in government and education, need to monitor for unauthorized changes that might indicate proxy or redirect abuse.