Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

Check Point Research uncovered a campaign by a Chinese-speaking cybercrime cluster linked to Earth Berberoka, active since mid-2025 against Brazilian government and educational sites. The attackers compromise web servers and install custom Apache modules that silently proxy visitors to attacker-controlled phishing pages mimicking app stores like Google Play and Microsoft Store. This enables large-scale SEO manipulation by chaining compromised high-reputation domains to inflate search rankings and hijack traffic. The group deploys a broad Linux toolkit with tools such as DownPro downloader, AlphaAgent and oRAT backdoors, a 3snake credential stealer, and SSH brute-forcers, all heavily obfuscated to evade detection. The campaign extends beyond Brazil with similar phishing networks targeting other regions. The infrastructure is one configuration change away from pushing malware directly to victims, representing a significant latent threat.

The campaign compromises legitimate Brazilian government and educational websites to proxy visitors to phishing pages, undermining trust in these sites and enabling large-scale SEO fraud. Victims are exposed to phishing that impersonates trusted app stores, potentially leading to credential theft and fraud. The attackers’ toolkit includes backdoors and credential stealers, increasing risk of further compromise. The infrastructure’s scalability and multi-region targeting indicate a broad and persistent threat. The latent capability to push malware directly from these phishing pages elevates the risk of malware infections beyond the current SEO manipulation and phishing activities.

No official patch or remediation is indicated for this campaign as it involves compromised third-party servers and attacker-controlled infrastructure. Organizations should audit and secure their web servers, especially Apache configurations, to detect and remove unauthorized modules. Monitoring for unusual proxying behavior and unauthorized changes to web server modules is recommended. Since the campaign leverages compromised government domains, affected organizations should conduct thorough incident response to identify and remediate intrusions. Users should be cautioned against downloading apps from phishing pages impersonating legitimate app stores. Patch status is not yet confirmed — check vendor advisories and security research updates for guidance.