Phishing Campaign Impersonating pcivil.rj.gov.br

Executive Summary

Dymo's automated threat detection systems identified a phishing campaign specifically targeting users of the Civil Registry Portal (pcivil.rj.gov.br) operated by the Government of Rio de Janeiro, Brazil. Attackers created convincing fake portals to harvest sensitive user data.

Campaign Details

Target Information

• Official Portal: pcivil.rj.gov.br
• Organization: Government of Rio de Janeiro
• Function: Civil registry services, vital records
• Users Affected: Brazilian citizens seeking civil documentation

Attack Methodology

The threat actors employed multiple techniques:

1. Domain Registration: Acquired lookalike domains (e.g., pcivil-rj.com, pcivil-gov-br.com)
2. Site Cloning: Complete replication of the official interface
3. Credential Harvesting: Fake login forms capturing username/password
4. Data Exfiltration: Real-time transmission of captured data

Information at Risk

Victims who interacted with the fake portals may have exposed:

• CPF (Brazilian tax ID) numbers
• Full names and addresses
• Birth dates and family information
• Login credentials
• Security questions and answers

Technical Analysis

Infrastructure

• Newly registered domains (within weeks of detection)
• Free hosting providers used
• Rapid domain rotation to evade blacklists
• Multiple redirect chains to obscure final destination

Red Flags Identified

• Mismatched SSL certificates
• URL differences from official domain
• Form submissions to third-party endpoints
• Absence of proper security headers

Remediation

For affected users:

1. Change passwords immediately if credentials were submitted
2. Monitor financial statements for unauthorized activity
3. Consider credit freezes with Brazilian credit bureaus
4. Report identity theft to proper authorities

For authorities:

1. Domain suspension requests to registrars
2. IP blocking at major ISPs
3. Public awareness campaigns

---

This campaign was detected through Dymo's continuous scanning and threat intelligence platform.