OTX Threat: Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

A Chinese-speaking cybercrime group dubbed Gambling Goblin has conducted a sustained campaign against Brazilian organizations since mid-2025, primarily targeting government and educational institutions. The attackers compromise web servers and install malicious Apache modules that silently reverse-proxy visitors to phishing pages while appearing to originate from legitimate domains. These phishing Sectors: Government, Education