With over 4K potentially compromised victims, it hits Tech and Manufacturing hardest.
Here's what your SOC team needs to know to protect your organization: https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
We recovered a Node.js/Electron backdoor with /nbw/ beaconing, 180-second task checks, eval()-based JavaScript execution, EXE delivery, and login persistence — capabilities that can turn a clean-looking sample into longer access, follow-on payload delivery, and higher fraud or data-exposure risk.
The durable signal is the build and execution chain: Delphi/Inno installer ➡️ patched Electron/Boostnote app ➡️ malicious index.js ➡️ HTTP beaconing ➡️ JS/EXE tasking.
That pattern helped us connect 231 sandbox analyses to the same PhantomEnigma cluster, even as domains, IPs, and delivery infrastructure changed ❗️
Full investigation: https://any.run/cybersecurity-blog/phantomenigma-research/