PhantomVAI Loader
PhantomVAI Loader is a .NET/C# malware loader tracked by Palo Alto Networks Unit 42 and also referred to in the provided content as the Katz Stealer Loader. It has been distributed in phishing campaigns, including shipment-themed lures, and is used to deliver multiple follow-on payloads such as AsyncRAT, XWorm, Formbook, DCRat, stealers, and specifically Katz Stealer. Reported infection chains use phishing emails carrying archives with ISO or IMG disk images or obfuscated JavaScript/VBS droppers; the first stage contains a Base64-encoded PowerShell script, which then downloads a GIF or image file containing a hidden Base64-encoded DLL payload via steganography. One reported sample used the markers "<<sudo_png>>" and "<<sudo_odt>>" to delimit hidden payload data inside an image. The loader performs anti-analysis checks including VM detection, establishes persistence, and loads the final payload. It has been reported to inject payloads through process hollowing into legitimate processes, most commonly MSBuild.exe from .NET Framework directories. The use of steganography in images and injection of Katz Stealer were specifically highlighted as techniques to evade sandbox analysis.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
5 techniques
Execution
Этап 1. Обфусцированный JavaScript/VBS содержит Base64-кодированный PowerShell-скрипт, который исполняется для загрузки следующей стадии.
JavaScript/VBS-дропперы. Архив содержит обфусцированный скрипт, который запускает многоступенчатую цепочку загрузки.
JavaScript/VBS-дропперы. Архив содержит обфусцированный скрипт, который запускает многоступенчатую цепочку загрузки.
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
5 techniques
Stealth
PowerShell скачивает GIF или изображение, внутри которого скрыт payload методом стеганографии... это Base64-закодированная DLL.
Инъекция payload - через process hollowing (T1055.012) в легитимный процесс. По наблюдениям Unit 42, в большинстве случаев целью служит MSBuild.exe.
Discovery
1 technique
Discovery
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Related .NET loader used in phishing campaigns to deliver stealer payloads through a multi-stage chain involving obfuscated scripts, PowerShell, steganography, environment checks, persistence, and final payload injection via process hollowing.
Phishing-delivered loader used to deploy follow-on payloads including RATs and information stealers; originally used to deliver Katz Stealer.
A loader reported to use image steganography to inject a secondary payload (Katz Stealer) and evade sandbox analysis.
Malware loader distributed via phishing, delivers stealers and RATs, uses VM checks, persistence, and process hollowing.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.