{"id":243611,"date":"2026-09-04T01:35:54","date_gmt":"2026-09-04T06:35:54","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/09\/malicious-apache-modules-hijack-brazilian-government-site-traffic-to-push-betting-pages"},"modified":"2026-09-04T01:35:54","modified_gmt":"2026-09-04T06:35:54","slug":"malicious-apache-modules-hijack-brazilian-government-site-traffic-to-push-betting-pages","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/09\/malicious-apache-modules-hijack-brazilian-government-site-traffic-to-push-betting-pages","title":{"rendered":"Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/malicious-apache-modules-hijack-brazilian-government-site-traffic-to-push-betting-pages2.jpg\"><\/a><\/p>\n<p>A Chinese-speaking cybercrime cluster known as <strong>Gambling Goblin<\/strong> has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting.<\/p>\n<p>Check Point Research said it has tracked the campaign since mid-2025.<\/p>\n<p>The modules reverse-proxy visitors to a set of phishing pages while the traffic still appears to originate from the legitimate domain. The site\u2019s own security headers are stripped, allowing the injected content to run freely.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and sports betting. Check Point Research said it has tracked the campaign since mid-2025. The modules reverse-proxy [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,32,1490],"tags":[],"class_list":["post-243611","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-education","category-government"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=243611"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/243611\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=243611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=243611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=243611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}