Loading malware…
Phantom Stealer is a commercially sold .NET-based information stealer for Windows that operates as part of the broader Phantom Project malware-as-a-service ecosystem. It is designed to covertly harvest sensitive data from compromised endpoints, with a strong emphasis on browser-centric credential theft and session compromise. Reported collection targets include saved browser passwords, cookies, autofill data, session tokens, browsing history, payment information, cryptocurrency wallet data, messaging and email application data, FTP and SSH client credentials, VPN-related data, Wi-Fi credentials, clipboard contents, screenshots, and keystrokes. Some variants also include file-grabbing and downloader functionality.
Observed Phantom Stealer campaigns commonly use phishing as the initial access vector, including business-themed lures delivered in archive attachments containing obfuscated JavaScript, VBS, batch, or executable loaders. Infection chains frequently rely on staged PowerShell execution, embedded or encrypted payloads, reflective .NET loading, and in-memory execution to reduce on-disk artifacts. Multiple reports describe process injection or hollowing into legitimate Windows binaries such as Explorer, MSBuild, RegAsm, or aspnet_compiler to evade detection. Anti-analysis measures reported across samples include heavy obfuscation, hidden or encoded PowerShell, sandbox and virtual-machine checks, CIS-region checks in some related reporting, and other defenses intended to frustrate static and behavioral analysis.
Phantom Stealer has been observed establishing persistence in some cases through Run-key modifications, scheduled tasks, or dropped helper scripts. Exfiltration methods vary by build and operator configuration and have included SMTP, FTP, Telegram, Discord, HTTPS, and other channels, sometimes with redundant parallel paths. Stolen data is often archived before transmission.
The malware has been linked to phishing campaigns targeting banks and other high-value organizations, as well as manufacturing, technology, logistics, industrial, retail, and construction sectors. Group-IB reported multi-wave European phishing activity between late 2025 and early 2026, while other reporting tied Phantom Stealer to broader commodity cybercrime delivery ecosystems and crypter services. Multiple analyses also note code or lineage overlap with the open-source Stealerium project, indicating that Phantom Stealer is an actively developed commodity infostealer adapted for large-scale criminal use.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Activation is handled via WMI: GetObject("winmgmts:").Get("Win32_Process").Create("cmd.exe /c C:\Users\Public\SeedComplex.bat")
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
This campaign is a textbook example... combining open-source code (Stealerium base), deep obfuscation, and skilled loader engineering... pushing the boundary of what’s possible with “just scripts”
Assembles and executes a PowerShell payload responsible for the next stage of infection and, crucially, the reflective code injection that is Phantom’s trademark.
Activation is handled via WMI: GetObject("winmgmts:").Get("Win32_Process").Create("cmd.exe /c C:\Users\Public\SeedComplex.bat")
Stage 1: VBScript Dropper... The dropper constructs Scripting.FileSystemObject and writes a heavily obfuscated batch file...
In observed Phantom Stealer campaigns, the malware is typically delivered through phishing lures or cracked software bundles targeting Windows users. Upon initial execution from a user profile or temporary directory, the malware rapidly enumerates installed applications...
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
anti-VM checks, persistence via registry or scheduled task... Persistence through task scheduler, registry, or dropped scripts
Implements advanced memory scanning, process hollowing, and fully in-memory payload execution... classic process hollowing against MSBuild.exe or similar.
The script’s surface was a tangled web of Chr() arithmetic, farm-themed variable names, and aggressive string concatenation... Junk strings replace executable commands... split into multiple fragments and littered with “mango”/“avocadopapaya” to defeat automated forensics.
Implements advanced memory scanning, process hollowing, and fully in-memory payload execution... classic process hollowing against MSBuild.exe or similar.
Implements advanced memory scanning, process hollowing, and fully in-memory payload execution... classic process hollowing against MSBuild.exe or similar.
It wasn’t simply Base64, it was Base64 + XOR + donut.
the malware also can capture financial data, cryptocurrency wallet information, keystrokes, screenshots, and clipboard contents.
What’s at Risk? Immediate compromise of browser credentials, session tokens, crypto wallets.
WinSCP stores sensitive SSH and FTP session credentials, including passwords and private key references, under the user profile path Martin Prikryl\WinSCP 2\Configuration\Security. Information-stealing malware such as Phantom Stealer targets this directory to harvest stored credentials for exfiltration.
the malware also can capture financial data, cryptocurrency wallet information, keystrokes, screenshots, and clipboard contents.
Potential webcam and screenshot exfiltration for blackmail or further intrusion.
the malware also can capture financial data, cryptocurrency wallet information, keystrokes, screenshots, and clipboard contents.
Following collection, Phantom Stealer compressed the harvested data into an archive and transmitted it via HTTPS POST to its command-and-control server.
with exfiltration through four parallel channels (Telegram, Discord, FTP, SMTP) for redundancy
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information-stealing malware that harvests host information, installed applications, browser credentials, cookies, stored payment information, cryptocurrency wallet data, and messaging application data, then exfiltrates the stolen information over authenticated SMTP with STARTTLS.
An information-stealing malware that harvests host information, installed applications, browser credentials, cookies, stored payment information, cryptocurrency wallets, and messaging application data, then exfiltrates the stolen data over authenticated SMTP with STARTTLS.
A fileless stealer referenced for comparison, noted for targeting browser cookies and session tokens.
An infostealer observed being delivered by Cruciferra.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.