Phantom Stealer
Phantom Stealer is a commercially sold .NET-based information stealer, also described as part of the Phantom Project malware-as-a-service kit that bundles an infostealer with a crypter and a RAT. Multiple sources in the content state it is derived from the open-source Stealerium codebase, with reported code overlap with Stealerium and Warp Stealer. It has been marketed via phantomsoftwares.site and the Telegram handle @Oldphantomoftheopera, and some reporting refers to versions including Phantom Stealer v3.5/v3.5.0.
Observed delivery vectors are primarily phishing-based. Campaigns described in the content used archive attachments containing ISO or IMG disk images, malicious executables, obfuscated JavaScript or VBS droppers, ZIP archives, fake payment confirmations, adult-content and payment-themed lures, fake Adobe installer themes, and DLL sideloading chains. Specific infection chains included JavaScript-to-PowerShell loaders, steganographically hidden payloads in image files, reflective .NET loading, AutoIt droppers, and XLoader-assisted delivery. Process injection or hollowing into legitimate Windows binaries was repeatedly reported, including MSBuild.exe, RegAsm.exe, aspnet_compiler.exe, msiexec.exe, and AddInProcess32.exe.
Capabilities consistently described in the content include theft of browser credentials, cookies, session tokens, credit card data, Discord tokens, Telegram artifacts, email and messaging data, Wi-Fi credentials, VPN/FTP credentials, clipboard contents, screenshots, keystrokes, and file grabbing. It also targets cryptocurrency data, including browser-extension wallets and desktop wallet applications. Reported exfiltration channels include Telegram, Discord webhooks, SMTP, FTP, Zulip, and GoFile, and some analyses state stolen data is archived into a password-protected ZIP before exfiltration.
Behavior and evasion features mentioned in the content include optional persistence via HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Run/RunOnce registry keys, scheduled tasks, VBS launchers in AppData, file copies in AppData or Temp, Windows Defender exclusions, VM/sandbox detection, CIS locale checks, anti-analysis logic, and in one report self-deletion when analysis environments are detected. One analysis also reported process monitoring for injected hosts and repeated relaunch behavior.
Campaign targeting in the content spans multiple regions and sectors. Group-IB-linked reporting described multi-wave phishing operations between November 2025 and January 2026 against manufacturing, technology, logistics, and industrial organizations in Europe. Seqrite and other reporting described Operation MoneyMount-ISO targeting Russian finance, accounting, treasury, procurement, legal, payroll, and related Russian-speaking organizations using ISO-based phishing. Additional reporting noted malspam activity affecting Italy and broader targeting of retail, construction, industrial, and IT sectors.
High-confidence infrastructure and identifiers directly mentioned in the content include phantomsoftwares.site, Telegram contact @Oldphantomoftheopera / t.me/Oldphantomoftheopera, and IP address 199.188.201.183. Sample and payload hashes explicitly tied to Phantom Stealer delivery or payload stages in the content include 129ad6e221e949303456a7b3cf381d9f1b1e97b203c689b9b1205d4d37693b28, 195e3d859d8fa9d0c12cd38beef8898e307b71422c8a18c2c3648f5f0220b447, 481fd4fefa706e606cfc368c68f1ef313f07c6e2849a26d7c94f7c8433884a1b, and 7eb8ae8f1216a377da6ccd0cee0b21f2700e9bbc46ae3ebfa876e70296aa4539.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
6 techniques
Execution
После запуска Phantom Stealer использует несколько механизмов persistence одновременно: ... Создание задачи в планировщике Windows
Further the DLL make sure the current directory is not “C:\\Windows\\System32” or “C:\\Windows\\SysWOW64” then execute the PowerShell and kill below 3 processes.
JavaScript/VBS-дропперы. Архив содержит обфусцированный скрипт, который запускает многоступенчатую цепочку загрузки.
JavaScript/VBS-дропперы. Архив содержит обфусцированный скрипт, который запускает многоступенчатую цепочку загрузки.
Persistence
2 techniques
Persistence
Privilege Escalation
4 techniques
Privilege Escalation
После запуска Phantom Stealer использует несколько механизмов persistence одновременно: ... Создание задачи в планировщике Windows
After that the DLL download the actual payload from url passed as argument to the DLL and replace “Dtre” with “/d” or “Dgtre” with “+” and inject the executable in RegAsm.exe process upon execution.
Stealth
8 techniques
Stealth
Криптер - обфускатор для обхода антивирусных движков (T1027.002, Software Packing).
After that the DLL download the actual payload from url passed as argument to the DLL and replace “Dtre” with “/d” or “Dgtre” with “+” and inject the executable in RegAsm.exe process upon execution.
Инъекция payload - через process hollowing (T1055.012) в легитимный процесс. По наблюдениям Unit 42, в большинстве случаев целью служит MSBuild.exe.
then execute the PowerShell and kill below 3 processes. RegAsm.exe Vbc.exe MsBuild.exe
...в большинстве случаев целью служит MSBuild.exe из каталогов .NET Framework - злоупотребление доверенной утилитой разработчика (T1127.001).
Лоадер (C#) делает три вещи: проверяет окружение на виртуальную машину... если VM обнаружена, выполнение может прерываться или модифицироваться... Антианализ включает проверку окружения на наличие антивирусных продуктов, виртуальных машин и песочниц.
Credential Access
5 techniques
Credential Access
Discord tokens are extracted from local storage LevelDB files and validated against https://discord.com/api/v9/users/@me .
Browser credential harvesting. It reads Login Data (SQLite), Cookies (SQLite), and Web Data from all Chromium user profiles.
Discovery
6 techniques
Discovery
T1012 Query Registry Telegram, Outlook, WinSCP, crypto wallet registry queries
WiFi passwords : Executes netsh wlan show profile name="<SSID>" key=clear for each saved network.
Further it checks every 60 seconds that if the RegAsm.exe is running or not and if there is error it will run previously mentioned VBS script.
T1083 File and Directory Discovery Browser/wallet directory enumeration
Collection
3 techniques
Collection
Command and Control
2 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial malware-as-a-service kit centered on a .NET infostealer that steals browser credentials, cookies, session tokens, payment data, messenger/email data, crypto-wallet data, screenshots, and keystrokes. It uses phishing delivery, multi-stage loaders, persistence, anti-analysis checks, and exfiltration via Telegram, Discord, SMTP, Zulip, and GoFile.
A .NET-based stealer used in phishing campaigns to steal credentials, evade analysis, and exfiltrate data. It is offered as part of the Phantom Project cybercrime kit and is associated with identity-driven compromise.
Commercially sold .NET infostealer delivered through a multi-stage JavaScript and PowerShell dropper chain, culminating in in-memory execution inside aspnet_compiler.exe. It steals browser credentials, cookies, session tokens, Discord and Telegram data, crypto wallet data, email and FTP client credentials, WiFi passwords, clipboard contents, and also includes keylogging, screenshot capture, optional persistence, file grabbing, and multiple exfiltration channels including Discord webhook, Telegram bot, FTP, and SMTP.
Commercially sold .NET infostealer delivered through a multi-stage chain involving an obfuscated WSH JavaScript dropper, PowerShell loader, and DEV.DOWN injector. It steals browser credentials, cookies, session tokens, Discord and Telegram data, crypto wallets, email and FTP client data, WiFi passwords, clipboard contents, and also includes keylogging and screenshot capture. Exfiltration is performed via Discord webhook, Telegram bot, FTP, or SMTP.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.