Loading story…
A sophisticated phishing campaign known as Operation MoneyMount-ISO has been identified targeting finance, accounting, treasury, and payment departments in Russia. Attackers use Russian-language emails impersonating financial institutions, such as TorFX Currency Broker, to deliver ZIP attachments containing malicious ISO files. When executed, these ISO files mount as virtual drives and deploy executables that load the Phantom information-stealing malware, which is capable of credential theft, invoice and payment fraud, and unauthorized fund transfers. The campaign also targets secondary sectors including procurement, legal, HR/payroll, executive assistants, and Russian-speaking SMEs, posing significant risks of lateral movement within IT systems.
Technical analysis reveals that the infection chain involves a multi-stage payload delivery, with the initial executable loading a DLL (CreativeAI.dll) that decrypts and injects the final Phantom Stealer payload into memory. The campaign demonstrates advanced social engineering and technical sophistication, leveraging fake payment confirmation lures and ISO mounting to bypass traditional security controls. Security researchers emphasize the need for heightened vigilance among Russian financial organizations and recommend monitoring for related IOCs and MITRE ATT&CK techniques associated with this threat.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed that Phantom Stealer exfiltrates stolen data through redundant channels including Telegram, Discord, and FTP, and uses anti-analysis checks that can trigger self-deletion in monitored or virtualized environments. Indicators of compromise and defensive recommendations were published to help organizations detect and respond to the campaign.
Analysis showed that when victims opened the ZIP-delivered ISO image, it mounted as a virtual drive and launched executables that deployed Phantom Stealer in a multi-stage infection chain. The malware was described as stealing credentials, browser data, cryptocurrency wallet information, Discord tokens, clipboard contents, and keystrokes.
Seqrite Labs identified an active phishing campaign dubbed Operation MoneyMount-ISO targeting Russian-speaking organizations, especially finance and accounting functions. The campaign used Russian-language lures impersonating TorFX Currency Broker or payment confirmations to deliver malicious ZIP attachments containing ISO files.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A multi-stage phishing campaign is delivering **Phantom Stealer v3.5.0** through compressed archive attachments that contain obfuscated JavaScript, using shipment and tax-audit lures that impersonate trusted organizations including **UPS Forwarding Hub** and Malaysia’s **Inland Revenue Board (LHDN)**. After a victim opens the attachment, the JavaScript launches hidden PowerShell stages that decode and decrypt additional payloads with **AES** and **XOR**, keeping much of the activity in memory to reduce detection. The final payload is reflectively executed and injected into `aspnet_compiler.exe`, where it steals system information, browser credentials, cookies, payment card data, cryptocurrency wallet files, and messaging application data. The stolen information is then exfiltrated over authenticated **SMTP** on **TCP port 587** using **EHLO**, **STARTTLS**, and **AUTH LOGIN** with Base64-encoded credentials; researchers said they could not conclusively attribute the activity to a specific threat actor, noting that Phantom Stealer is broadly available in the cybercriminal ecosystem.
Jul 22, 2026
PhantomStealer v3.5.0 was deployed in multiple phishing campaigns using invoice, RFQ, maritime, and industrial lures delivered as heavily obfuscated JavaScript droppers. Across the observed samples, the malware followed a consistent multi-stage chain: Windows Script Host launched PowerShell, decrypted additional payloads, reflectively loaded .NET components, and hollowed the signed Microsoft binary `Aspnet_compiler.exe` to run the final infostealer. Researchers tied the activity to the PhantomStealer malware-as-a-service ecosystem advertised via `phantomsoftwares.site` and the Telegram identity **Oldphantomoftheopera**, with builder-generated samples showing per-build customization but a stable framework, anti-analysis logic, and optional persistence. The payloads stole browser credentials, cookies, credit cards, email and messaging data, Wi-Fi passwords, screenshots, keystrokes, and cryptocurrency wallet information, while some builds also enabled a crypto clipper that replaced wallet addresses across multiple chains. The campaigns abused legitimate but compromised infrastructure for both delivery and exfiltration, including a Portuguese theater website hosting encrypted PowerShell stages, a Chilean mail server and a Malaysian business email account used as SMTP relays, and Romanian FTP hosting used by another PhantomStealer build. Exfiltration varied by sample—SMTP to attacker mailboxes at `graceishere.tech`, Telegram Bot API, Discord, or FTP—but infrastructure overlap repeatedly linked the deployments back to the same MaaS operation, and one report also connected a PhantomStealer FTP campaign to related AgentTesla activity through shared submissions and tooling. The targeting and lure themes indicate a focus on procurement, shipping, maritime, industrial, and accounts receivable personnel, while the repeated use of compromised SMB hosting and mail systems suggests operators favored hijacked third-party services over dedicated attacker-owned infrastructure.
Jun 29, 2026
A previously undocumented .NET-based malware, dubbed CAPI Backdoor, has been identified as the payload in a targeted phishing campaign against Russian automotive and e-commerce companies. The attack begins with spear-phishing emails containing a ZIP archive, which was first observed on VirusTotal on October 3, 2025. This ZIP file includes a Russian-language decoy document, purporting to be a notification about income tax legislation or payroll recalculation, and a malicious Windows shortcut (LNK) file. The LNK file, named identically to the ZIP archive, is engineered to execute the CAPI Backdoor DLL (adobe.dll) using the legitimate Windows binary rundll32.exe, a classic living-off-the-land (LotL) technique that helps evade detection. Once executed, the backdoor checks for administrator privileges, enumerates installed antivirus products, and opens the decoy document to distract the user while it operates covertly. The malware establishes persistence by creating a scheduled task and placing a shortcut in the Windows Startup folder, ensuring it runs on system reboot. CAPI Backdoor connects to a remote command-and-control server at 91.223.75[.]96, from which it can receive further instructions. Its capabilities include stealing data from popular web browsers such as Chrome, Edge, and Firefox, taking screenshots, collecting detailed system information, and enumerating folder contents for exfiltration. The malware also performs extensive checks to determine if it is running in a virtual machine or sandbox environment, likely as an anti-analysis measure. Infrastructure analysis revealed that one of the domains used in the campaign is linked to the Russian automotive sector, supporting the assessment that this industry is a primary target. The campaign also impacts the broader e-commerce sector within Russia, as indicated by the targeting patterns and decoy content. Seqrite Labs, which conducted the technical analysis, has provided indicators of compromise (IOCs) and mapped the attack to relevant MITRE ATT&CK techniques. The campaign demonstrates a sophisticated use of social engineering, leveraging localized decoy documents and legitimate system binaries to maximize infection success and persistence. The use of a previously unknown .NET implant highlights the evolving tactics of threat actors targeting Russian commercial sectors. Organizations in the affected industries are advised to update their security controls, educate employees about phishing risks, and monitor for the provided IOCs. The discovery underscores the ongoing threat posed by targeted phishing campaigns leveraging custom malware and advanced evasion techniques.
Jun 29, 2026