Check Point Research says a Chinese-speaking cybercrime cluster it calls Gambling Goblin has run a sustained campaign since mid-2025 against Brazilian organisations, mainly government and educational institutions. The attackers compile and install malicious Apache modules on compromised web servers; the modules reverse-proxy visitors to phishing pages posing as Google Play, Microsoft Store and Amazon while the traffic still appears to come from the legitimate domain, and strip the site's Content-Security-Policy headers so injected content runs freely.

The pages push online gambling and sports betting and chain compromised high-reputation domains, many of them Brazilian government sites, to inflate search rankings. Check Point also describes a Linux toolkit (the DownPro downloader, AlphaAgent and oRAT backdoors, a credential stealer and an SSH brute-forcer) and parallel phishing networks in Vietnamese, Spanish and English. Hunt for unexpected Apache modules and loadable objects, reverse-proxy behaviour and stripped CSP headers on public sites. (source: Check Point Research)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Check Point Research)