Someone searching in Portuguese for an app download can land on a page that looks like Google Play, sits on a Brazilian city hall's own domain, and quietly relays them to an online betting operation. Check Point Research spent months pulling that arrangement apart and published the result on September 2, 2026.
The researcher, Amit Yardeni, describes a Chinese-speaking cybercrime cluster Check Point has named Gambling Goblin, which it connects to Earth Berberoka, a group first documented targeting gambling sites across Asia. Since mid-2025 it has been working through Brazilian organizations, primarily government and educational institutions. That is a shift worth noting on its own: Brazil's cybercrime problem is usually home-grown banking trojans, not a foreign operator moving in.
A web server that lies about where its pages come from
The trick sits inside Apache. Once on a server, the group compiles and installs a custom Apache module, opsproxy.c, using the server's own build tooling. The module inspects every incoming request for a small set of hardcoded path prefixes, /wps, /bmw and /card in the samples Check Point examined. A request to one of those paths is silently reverse-proxied to attacker infrastructure, while to the outside world the response still appears to come from the legitimate domain.
It goes one step further. The module strips the site's Content-Security-Policy header, the browser rule that decides which scripts a page is allowed to run, and replaces it with a permissive one allowing inline scripts, dynamically evaluated code and third-party assets. The compromised site's own protections are switched off, but only along the attackers' paths.
The installer script cleans up behind itself, deleting the source and build artifacts and timestomping the resulting module to match legitimate Apache components such as mod_ssl. Check Point notes the script's status messages are written in Chinese and decorated with emoji, a style the researcher suggests may point to AI-assisted development.
Borrowed trust, at the scale of a government
One phishing page led Check Point to dozens more. Its app tiles and navigation links pointed not at a single server but at real Brazilian domains, the majority of them legitimate .gov.br sites, each serving the attackers' gambling pages under paths like /jogos and /nova. The compromised institutions span every level of Brazilian government: a federal ministry and a national public agency, a state legislative assembly, state courts of accounts and a state-owned utility, and above all municipal administrations spread across numerous cities and multiple states. A smaller set of commercial .com.br sites, local news outlets, health clinics and business associations, rounds out the list.
The point of hijacking a government domain is its reputation. Search engines trust it, so content served through it climbs the rankings and the traffic follows. The pages themselves impersonate Google Play, the Microsoft Store and Amazon, dressed up with fabricated ratings, review counts and schema.org metadata built to satisfy a crawler.
One configuration change from something worse
Check Point's sharpest observation is about what has not happened yet. Because the pages already pose as app download destinations, the same infrastructure sits a single configuration change away from pushing malware straight to visitors. Nothing would need rebuilding.
Inside the victim servers the group runs a broad, heavily obfuscated Linux toolkit: a Go downloader called DownPro that drops payloads under names like /usr/local/bin/systemd-udevd, a modular Go backdoor named AlphaAgent that renames its own process to pass as a kernel thread, the oRAT remote access tool, a credential stealer based on 3snake that watches sshd and sudo, and a plugin-driven reconnaissance agent the operators call cam-agent. Off-the-shelf utilities including netcat, fscan and pwnkit fill the gaps.
And it is not only Brazil. Check Point found the same phishing template localized in Vietnamese, Spanish and English, alongside domain generators producing fresh hostnames daily to outpace blocklists and takedowns. The Brazilian campaign is a deployment of a playbook, not the playbook itself.
Look for an Apache module you did not install
There is no patch here, because there is no single vulnerability being exploited. Server operators should audit loaded Apache modules against what they intentionally installed, treat a module whose timestamp exactly matches mod_ssl as suspicious rather than reassuring, and question any unexplained enabling of the stock proxy, headers and rewrite modules. One phishing host Check Point names is playfootball[.]info. Sample hashes from the toolkit include 232ef6be134c2b7c14648aa193daf7e23e987477b8a40150dd77883947fdf017 and 088d0742a667f1acfc83edb94671a10b951f6745badec6d5c754ef594dddf815, and the full indicator set is in Check Point's report.
Brazil has had a busy few weeks, including a separate crew caught moving money directly inside bank payment systems. What is different here is the patience. Nobody appears to have stolen anything from the ministries and city halls involved. The attackers took something less obvious, which is the credibility those domains had spent years building, and quietly rented it out.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.