Loading malware…
Phantom Stealer is a modular, .NET-based information-stealing malware family targeting Windows endpoints. It harvests saved browser credentials, cookies, session tokens, autofill entries, browsing history, and payment-card data from Chromium- and Gecko-based browsers. It also targets cryptocurrency wallets and browser wallet extensions, messaging application sessions, email client data, FTP and SSH client credentials, Wi-Fi passwords, and selected local files. Additional surveillance capabilities include keylogging, screenshot capture, clipboard collection, and host and installed-application discovery. Its cryptocurrency clipboard replacement functionality can substitute attacker-controlled wallet addresses to redirect payments.
Distribution methods include phishing emails, cracked or pirated software, and malicious links circulated through Discord and Telegram. Observed phishing campaigns use shipping, banking, and tax-themed lures, including impersonation of UPS and the Malaysian Inland Revenue Board. Infection chains frequently begin with compressed archives containing obfuscated JavaScript, followed by hidden PowerShell execution and staged .NET loading. Loaders can conceal encoded or encrypted payloads in PNG resources or JPEG images, execute assemblies in memory, and use process injection or process hollowing to deploy the stealer within legitimate Windows processes.
Phantom Stealer checks for virtualization, sandbox environments, analysis tools, and suspicious host or network characteristics before collecting data. It can delay or terminate execution when analysis is suspected and establish persistence through registry autorun entries and Startup-folder entries. Harvested information is packaged into archives and exfiltrated, with multiple campaigns using authenticated SMTP and STARTTLS. The family is used within the commodity cybercrime ecosystem, has been deployed by XWorm operators, and has been distributed using the Cruciferra crypter service.
63 distinct techniques documented for this family, organized by ATT&CK tactic.
Commonly distributed through phishing emails, cracked software, Discord, Telegram, and malicious links
The infection begins when an unsuspecting victim receives a phishing email carrying a malicious archive attachment.
“Since the initial delivery mechanism is phishing, we map this activity to ... T1566.002 (Phishing: Spearphishing Link).”
CAPA mapping identifies execution via WMI.
“The malware also uses different persistence techniques, including startup entries and scheduled tasks & services, to remain on the system.”
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
CommandHelper executes arbitrary system commands.
A PowerShell script loads the .NET assembly, using Base64-decoded data extracted from a JPG, into process memory.
Activation is handled via WMI: GetObject("winmgmts:").Get("Win32_Process").Create("cmd.exe /c C:\Users\Public\SeedComplex.bat")
Stage 1: VBScript Dropper... The dropper constructs Scripting.FileSystemObject and writes a heavily obfuscated batch file...
“The archive contains an obfuscated JavaScript file. MITRE ATT&CK Mapping - Execution: T1059.007 (Command and Scripting Interpreter: JavaScript).”
...в большинстве случаев целью служит MSBuild.exe из каталогов .NET Framework - злоупотребление доверенной утилитой разработчика (T1127.001).
In observed Phantom Stealer campaigns, the malware is typically delivered through phishing lures or cracked software bundles targeting Windows users. Upon initial execution from a user profile or temporary directory, the malware rapidly enumerates installed applications...
Commonly distributed through phishing emails, cracked software, Discord, Telegram, and malicious links
“The malware also uses different persistence techniques, including startup entries and scheduled tasks & services, to remain on the system.”
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
Startup establishes persistence by installing startup entries and registry keys.
“The malware also uses different persistence techniques, including startup entries and scheduled tasks & services, to remain on the system.”
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
Implements advanced memory scanning, process hollowing, and fully in-memory payload execution... classic process hollowing against MSBuild.exe or similar.
Implements advanced memory scanning, process hollowing, and fully in-memory payload execution... classic process hollowing against MSBuild.exe or similar.
Startup establishes persistence by installing startup entries and registry keys.
The loader reverses strings and uses Base64-encoded data, including data extracted from a JPG, to conceal the assembly, URL, and payload.
Криптер - обфускатор для обхода антивирусных движков (T1027.002, Software Packing).
“The script searches the file for the pattern BaseStart-(.*?)-BaseEnd. The data found between BaseStart- and -BaseEnd is then Base64-decoded” and “the file is actually a JPG image.”
Attackers also recycled email templates, used impersonal greetings, and spoofed business identity in the campaign.
Implements advanced memory scanning, process hollowing, and fully in-memory payload execution... classic process hollowing against MSBuild.exe or similar.
Implements advanced memory scanning, process hollowing, and fully in-memory payload execution... classic process hollowing against MSBuild.exe or similar.
If analysis is detected, the malware terminates and cleans itself up using SelfDestruct.Melt(); CAPA also identified file deletion.
...в большинстве случаев целью служит MSBuild.exe из каталогов .NET Framework - злоупотребление доверенной утилитой разработчика (T1127.001).
The input string is reversed and Base64-decoded to reveal a payload URL; downloaded content is then reversed and Base64-decoded into executable bytes.
Main() calls AntiAnalysis.Run(); if a sandbox or virtualized environment is detected, the malware terminates and invokes SelfDestruct.Melt().
AntiAnalysis checks hosting-provider status, GPU adapters, running processes and services, sandbox DLLs, external IPs, hostname, username, and MachineGuid values against blocklists.
AntiAnalysis.Emulator() verifies whether execution delays and sleep functions have been artificially fast-forwarded; the malware also includes StartDelay.
The PowerShell script loads the .NET assembly into process memory, and CAPA identified reflective code loading in stub.exe.
CAPA mapping for the binary includes File and Directory Permissions Modification.
Добавление исключения для себя в Windows Defender через PowerShell ( Add-MpPreference -ExclusionPath )
Phantom Stealer is a .NET-based credential-harvesting malware designed to stealthily steal browser credentials, saved passwords, session cookies, cryptocurrency wallet data, clipboard contents, and system information
Keylogger intercepts and logs keystrokes in real time.
Discord extracts Discord tokens and session data.
ChromiumRecovery / GeckoRecovery extract stored session cookies from Chromium- and Gecko-based browsers.
Wifi extracts stored Wi-Fi passwords, while FileGrabber searches for files matching targeted extensions across the filesystem.
It primarily targets browser credential stores, saved passwords, cookies, autofill data, and session tokens from popular browsers such as Chrome, Edge, and Firefox.
ChromiumRecovery / GeckoRecovery extract stored credentials, session cookies, credit-card numbers, and autofill profiles using DPAPI, AES-GCM, and 3DES decryption routines.
BrowserWallets, BrowserWalletExtensionsHelper, and DesktopWallets target browser-extension and desktop cryptocurrency wallet data.
AntiAnalysis.SuspiciousMachineGuid() matches the registry MachineGuid value against known analysis systems.
The malware queries ip-api.com/json to inspect the current connection and contains WiFi functionality for network discovery.
AntiAnalysis.SuspiciousPCUsername() checks the current username against a list of known automated-analysis profiles.
Full device fingerprinting — hardware, software, Wi-Fi profiles, environment info.
AntiAnalysis.SuspiciousProcess() checks currently running processes against analysis and monitoring tools, including VmRemoteGuest.exe and Sysmon64.exe.
SystemInfo gathers system metadata, hardware configurations, and OS details; anti-analysis also evaluates GPU and host characteristics.
CAPA mapping includes File and Directory Discovery, and FileGrabber searches the filesystem for files matching selected extensions.
CAPA mapping for stub.exe includes Account Discovery.
Main() calls AntiAnalysis.Run(); if a sandbox or virtualized environment is detected, the malware terminates and invokes SelfDestruct.Melt().
AntiAnalysis checks hosting-provider status, GPU adapters, running processes and services, sandbox DLLs, external IPs, hostname, username, and MachineGuid values against blocklists.
AntiAnalysis.Emulator() verifies whether execution delays and sleep functions have been artificially fast-forwarded; the malware also includes StartDelay.
The malware checks processes, services, sandbox DLLs, and security/virtualization-related software.
A stolen session cookie is not a stolen passkey. An infostealer may take an already authenticated browser session and bypass the login screen entirely.
Telegram scrapes desktop session files; Outlook/FoxMail recover email data; FileZilla/WinSCP recover stored connection data; FileGrabber stages targeted files.
Keylogger intercepts and logs keystrokes in real time.
Screenshot captures the current desktop screen.
Clipper / ClipLogger monitors and intercepts clipboard contents; CAPA also identifies Clipboard Data collection.
Potential webcam and screenshot exfiltration for blackmail or further intrusion.
ChromiumRecovery and GeckoRecovery query browser SQLite stores for credentials, cookies, credit-card data, and autofill profiles.
Once executed, it enumerates the victim system, collects targeted data, archives the harvested output, and exfiltrates it to attacker-controlled infrastructure over encrypted channels.
Reports / ZipManager compiles and compresses harvested credentials and logs into password-protected ZIP archives.
Following collection, Phantom Stealer compressed the harvested data into an archive and transmitted it via HTTPS POST to its command-and-control server.
FtpSendLogs / UploadToFtp can upload harvested files to remote FTP servers.
“The script sends an HTTP GET request to this URL” and “The script connects to a remote URL to download a resource hosted at ... optimized_MSI_nthgyz.jpg.”
RAT - модуль удалённого доступа для постэксплуатации (T1219, Remote Access Tools).
Following collection, Phantom Stealer compressed the harvested data into an archive and transmitted it via HTTPS POST to its command-and-control server.
with exfiltration through four parallel channels (Telegram, Discord, FTP, SMTP) for redundancy
The active configuration specifies SMTP server exczx.com and states that stolen data is exfiltrated via SMTP.
XWorm provided redundant access and exfiltration... and exfiltrated through the Telegram Bot API.
Modules include TelegramSendLogs / UploadToTelegram and DiscordSendLogs / UploadToDiscord.
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.