Ultimately I noticed a lot of new scams running around and some gov.br websites serving a lot of scams (they existed before only as redirects to scams, now they seem to be hosted in there too). A friend of mine tried to delete a 2FA token from her phone and got calls about that from a completely different "agency". Seems like the script kiddie bar got higher... Edit: But on this case, the article doesn't give any source