Loading story…
PhantomVAI Loader has emerged as a sophisticated malware delivery mechanism, leveraging steganography to conceal and deploy a range of information-stealing malware. Security researchers have observed that PhantomVAI Loader is distributed primarily through phishing campaigns, which use multi-stage and highly evasive infection chains to compromise victims. The loader initially gained notoriety for delivering Katz Stealer, a malware-as-a-service (MaaS) infostealer that collects sensitive data from infected machines. Over time, PhantomVAI Loader has evolved to deliver additional infostealers, including AsyncRAT, XWorm, FormBook, and DCRat, expanding its threat profile. The loader employs advanced steganography techniques, embedding malicious payloads within images to evade detection by security solutions and sandboxes. This method allows the loader to bypass traditional security controls, making it particularly challenging to detect and analyze. PhantomVAI Loader targets a wide array of industries, including manufacturing, education, utilities, technology, healthcare, information, and government sectors, indicating a broad and indiscriminate targeting strategy. The infection chain typically begins with a phishing email containing obfuscated scripts or loaders, which then use steganography to extract and execute the final payload. Researchers have traced the origins of Katz Stealer to underground forums, where it is marketed and sold to cybercriminals seeking to harvest credentials and sensitive information. The loader's modular design and ability to deliver multiple types of infostealers make it a versatile tool in the cybercriminal ecosystem. Security vendors have responded by updating detection capabilities in products such as advanced sandboxing and endpoint detection solutions. The use of steganography not only aids in payload delivery but also complicates forensic analysis and incident response efforts. Organizations are advised to enhance email security, monitor for suspicious image files, and educate users about phishing risks. The ongoing evolution of PhantomVAI Loader demonstrates the increasing sophistication of malware delivery techniques in the threat landscape. Collaboration between security researchers and vendors has been crucial in identifying and mitigating the risks posed by this loader. The widespread use of PhantomVAI Loader underscores the need for continuous vigilance and adaptive security measures in defending against modern malware campaigns.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said PhantomVAI used steganography in image files to inject Katz Stealer and evade sandbox analysis. This added technical detail about the loader's execution chain and defense-evasion methods.
Palo Alto Networks Unit 42 published research describing the PhantomVAI loader as a malware delivery mechanism used to deploy a range of infostealers. The report established the campaign and its role in distributing credential- and data-theft malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 67 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourceunit42.paloaltonetworks.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a widespread phishing-driven malware delivery operation using a custom loader dubbed **PhantomVAI**, which masquerades as legitimate software and uses **process hollowing** (RunPE) to inject payloads into legitimate Windows processes. The loader has been observed targeting users globally via malicious email attachments and links, then downloading and executing remote payloads in a way intended to blend into normal system activity and complicate detection. Analysis attributed to *Intrinsec* links PhantomVAI’s core execution to a legacy, open-sourced RunPE utility (“**Mandark**”) originally shared on hacking forums (including code fingerprints such as `Hackforums.gigajew`). Researchers also noted **Windows Task Scheduler masquerading** (e.g., appearing as `Microsoft.Win32.TaskScheduler.dll` based on a legitimate GitHub project) and shared code traits (e.g., a “VAI” method and Portuguese strings). Multiple vendors reportedly tracked the same loader under different names (e.g., **VMDetectLoader** and **Caminho Loader**), and it has been associated with delivering commodity malware families including **Remcos**, **XWorm**, **AsyncRAT**, **DarkCloud**, and **SmokeLoader**.
Jun 29, 2026
Researchers reported that updated **Vidar** infostealer campaigns are using steganography, fileless execution, and social-engineering lures to evade detection and steal corporate and consumer data. Point Wild and Intrinsec found infections delivered through fake GitHub repositories, compromised WordPress sites showing **ClickFix**-style fake CAPTCHA prompts, gaming cheat posts on Reddit and Discord, and bogus software promoted in YouTube videos and hosted on services such as Mediafire. In one chain, a fake tool named **NeoHub** dropped a malicious DLL disguised as a Microsoft Edge component and signed with counterfeit certificates impersonating GitHub and grow.com. The malware uses VBScript, obfuscated PowerShell, a Go-based loader, and trusted Windows binaries including `WScript`, `PowerShell`, and `RegAsm.exe` to fetch apparently harmless JPEG and TXT files that contain hidden Base64-encoded second-stage payloads, then reconstructs and executes them entirely in memory through .NET reflective loading. Researchers said Vidar now operates as a **Malware-as-a-Service** offering, uses Telegram and Dead Drop Resolver techniques via public Steam profiles to locate command-and-control infrastructure, and exfiltrates credentials, cookies, payment data, cryptocurrency wallet files, and information from more than 200 browser extensions, often through Telegram and Cloudflare-fronted domains to mask attacker activity.
Jun 29, 2026
Security researchers reported multiple malware delivery chains that **hide or embed executable payloads inside image files** to evade detection. Veracode analyzed a malicious typosquatted NPM package, `buildrunner-dev`, that uses a `postinstall` hook to run `init.js`, which downloads an obfuscated batch script (`packageloader.bat`) from a Codeberg repository. The batch script ultimately retrieves PNG images hosted on a free image service and extracts hidden data from RGB pixel values (steganography), leading to a loader with **process hollowing**, **encrypted payload handling**, **AMSI bypass**, and per-AV evasion logic, culminating in deployment of the **Pulsar .NET RAT**. Separately, SANS ISC documented a phishing/malspam-style infection chain starting from an Excel attachment exploiting **CVE-2017-11882** (Equation Editor), which downloads an HTA that launches PowerShell to fetch a PNG (`optimized_MSI.png`) containing a Base64-encoded .NET payload delimited by `BaseStart-` and `-BaseEnd` tags. The handler noted **reuse of the same image across campaigns**, used VirusTotal similarity searches to identify many related samples, and produced a YARA rule to track the technique. Kaspersky’s write-up on **Arkanix Stealer** describes a MaaS stealer ecosystem (C++ and Python variants, ChromElevator usage, and broad credential/crypto theft) but does not center on image-based payload hiding, making it a separate topic from the image-steganography delivery chains described by Veracode and SANS ISC.
Jun 29, 2026