Loading threat actor…
PhantomStealer is a malware-as-a-service information-stealer operation marketed under the PhantomStealer brand, including the Telegram identity Oldphantomoftheopera. It has been observed both as a commercially offered stealer service and as malware delivered in phishing campaigns. Reported variants include a .NET-based PhantomStealer v3.5.0 and a Stealerium-based Phantom Stealer used in campaigns targeting Russian users. PhantomStealer is designed for credential theft and data exfiltration. Observed capabilities include theft of browser passwords, cookies, autofill data, payment card data, email client data, WinSCP sessions, FileZilla credentials, Discord and Telegram data, Wi-Fi passwords, selected local files, and cryptocurrency wallet data, including browser wallet extensions. Some builds also include a crypto-clipper component that replaces copied wallet addresses in the clipboard. Reporting also attributes a webcam screenshot module used in adult-content-themed campaigns, consistent with sextortion-oriented abuse. Delivery has relied on phishing lures such as invoices, trade documents, payment themes, and adult-content baits. Observed infection chains use heavily obfuscated JavaScript droppers, PowerShell decryptors and loaders, reflective .NET loading, and process hollowing into legitimate Windows .NET binaries. Anti-analysis and defense-evasion measures reported across samples include script obfuscation, custom XOR decryption, AES-encrypted configuration, sandbox and process checks, self-deletion, and process hollowing. Some builds were configured to exfiltrate stolen data over SMTP using compromised third-party mail infrastructure rather than attacker-owned servers. PhantomStealer has targeted stored credentials in applications such as WinSCP and has been associated with campaigns aimed at procurement, shipping, and accounts receivable personnel involved in international trade. Separate reporting describes phishing attacks aimed at Russia delivering a Stealerium-derived Phantom Stealer variant. The operation is best characterized as financially motivated cybercrime centered on credential theft, data theft, and cryptocurrency theft.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.