Malware

PhantomBackdoor

PhantomBackdoor is a backdoor/trojan observed in a social-engineering-driven intrusion campaign reported by Cato CTRL Threat Research. In the described activity, attackers used voice phishing and Microsoft Teams as part of the delivery chain, including help desk impersonation, to guide victims into executing PhantomBackdoor. One report specifically describes it as a WebSocket-based trojan delivered via an obfuscated PowerShell script retrieved from an external server. The campaign was identified against an Italy-based engineering firm. The available content directly associates PhantomBackdoor with vishing- and Teams-enabled initial access and remote backdoor functionality, but does not provide further confirmed technical details, persistence mechanisms, or indicators of compromise.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598.004Spearphishing VoiceEvidence1

Cato CTRL identified a vishing technique delivering PhantomBackdoor against an Italy-based engineering firm

Initial Access

1 technique

T1566.003Spearphishing via ServiceEvidence1

Vishing and Microsoft Teams Used to Deliver PhantomBackdoor

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

guide victims into executing a WebSocket-based trojan dubbed PhantomBackdoor via an obfuscated PowerShell script retrieved from an external server.

T1059.001PowerShellEvidence1

SNOWBASIN... enable[s] remote command execution via "cmd.exe" or "powershell.exe"

Command and Control

1 technique

T1090ProxyEvidence1

SNOWGLAZE is a Python-based tunneler to create a secure, authenticated WebSocket tunnel between the victim's internal network and the attacker's command-and-control (C2) server.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Apr 23, 2026

UNC6692 Impersonates IT Help Desk via Microsoft Teams to Deploy SNOW Malware

A WebSocket-based trojan/backdoor delivered through a Microsoft Teams help-desk impersonation campaign, executed via an obfuscated PowerShell script retrieved from an external server.

blueteamsecNews

May 8, 2023

Vishing and Microsoft Teams Used to Deliver PhantomBackdoor - Infosec.Pub

A backdoor delivered via a vishing technique and Microsoft Teams in an attack against an Italy-based engineering firm.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.