Loading story…
Security researchers reported a widespread phishing-driven malware delivery operation using a custom loader dubbed PhantomVAI, which masquerades as legitimate software and uses process hollowing (RunPE) to inject payloads into legitimate Windows processes. The loader has been observed targeting users globally via malicious email attachments and links, then downloading and executing remote payloads in a way intended to blend into normal system activity and complicate detection.
Analysis attributed to Intrinsec links PhantomVAI’s core execution to a legacy, open-sourced RunPE utility (“Mandark”) originally shared on hacking forums (including code fingerprints such as Hackforums.gigajew). Researchers also noted Windows Task Scheduler masquerading (e.g., appearing as Microsoft.Win32.TaskScheduler.dll based on a legitimate GitHub project) and shared code traits (e.g., a “VAI” method and Portuguese strings). Multiple vendors reportedly tracked the same loader under different names (e.g., VMDetectLoader and Caminho Loader), and it has been associated with delivering commodity malware families including Remcos, XWorm, AsyncRAT, DarkCloud, and SmokeLoader.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Alongside its technical findings, Intrinsec recommended mitigations including enabling MFA for browser-related accounts and improving network monitoring for suspicious outbound command-and-control traffic. The guidance was aimed at reducing the impact of the infostealers commonly delivered by PhantomVAI campaigns.
Intrinsec reported that PhantomVAI was built by repurposing a decade-old RunPE utility and tied its lineage to the older Mandark tool through shared code traits and the "Hackforums.gigajew" namespace. The firm also documented the loader's use of process hollowing, Windows Task Scheduler masquerading, and a core component named Mandark (x64.load) in the infection chain.
Security organizations observed the same malware loader but referred to it by different names, including PhantomVAI, VMDetectLoader, and Caminho Loader. This created confusion around attribution and the loader's capabilities across reporting.
Threat actors deployed the custom Windows loader PhantomVAI in widespread worldwide campaigns, using phishing to infect victims and deliver infostealers and remote access trojans. The loader accepted arbitrary payload URLs and was assessed as potentially operating as a loader-as-a-service.
An open-source RunPE utility later referred to as Mandark was originally published by a HackForums user. Researchers later identified the namespace "Hackforums.gigajew" as a code fingerprint linking newer malware to this older tool.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PhantomVAI Loader has emerged as a sophisticated malware delivery mechanism, leveraging steganography to conceal and deploy a range of information-stealing malware. Security researchers have observed that PhantomVAI Loader is distributed primarily through phishing campaigns, which use multi-stage and highly evasive infection chains to compromise victims. The loader initially gained notoriety for delivering Katz Stealer, a malware-as-a-service (MaaS) infostealer that collects sensitive data from infected machines. Over time, PhantomVAI Loader has evolved to deliver additional infostealers, including AsyncRAT, XWorm, FormBook, and DCRat, expanding its threat profile. The loader employs advanced steganography techniques, embedding malicious payloads within images to evade detection by security solutions and sandboxes. This method allows the loader to bypass traditional security controls, making it particularly challenging to detect and analyze. PhantomVAI Loader targets a wide array of industries, including manufacturing, education, utilities, technology, healthcare, information, and government sectors, indicating a broad and indiscriminate targeting strategy. The infection chain typically begins with a phishing email containing obfuscated scripts or loaders, which then use steganography to extract and execute the final payload. Researchers have traced the origins of Katz Stealer to underground forums, where it is marketed and sold to cybercriminals seeking to harvest credentials and sensitive information. The loader's modular design and ability to deliver multiple types of infostealers make it a versatile tool in the cybercriminal ecosystem. Security vendors have responded by updating detection capabilities in products such as advanced sandboxing and endpoint detection solutions. The use of steganography not only aids in payload delivery but also complicates forensic analysis and incident response efforts. Organizations are advised to enhance email security, monitor for suspicious image files, and educate users about phishing risks. The ongoing evolution of PhantomVAI Loader demonstrates the increasing sophistication of malware delivery techniques in the threat landscape. Collaboration between security researchers and vendors has been crucial in identifying and mitigating the risks posed by this loader. The widespread use of PhantomVAI Loader underscores the need for continuous vigilance and adaptive security measures in defending against modern malware campaigns.
Jul 12, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Multiple active malware campaigns are delivering **remote access trojans (RATs)** using deceptive lures and multi-stage execution chains designed to evade endpoint defenses. Malwarebytes reported a campaign dubbed **DEAD#VAX** that distributes a file masquerading as a “PDF” but actually delivered as a **virtual hard disk (`.vhd`)** hosted via **IPFS**; when opened, Windows mounts the VHD and the victim is tricked into launching a **Windows Script File (`.wsf`)** that ultimately deploys **AsyncRAT**. The chain includes anti-analysis checks and **process injection** into Microsoft-signed binaries such as `RuntimeBroker.exe`, `OneDrive.exe`, `taskhostw.exe`, and `sihost.exe`, enabling hands-on-keyboard remote control while minimizing obvious on-disk artifacts. Separately, reporting described **DesckVB RAT v2.9**, a modular **.NET** RAT using an obfuscated **WSH JavaScript** stager followed by **PowerShell**-based anti-analysis checks and an in-memory (“fileless”) loader, emphasizing persistence and a plugin-based architecture for post-compromise capabilities. Another campaign distributes **ValleyRAT** disguised as a legitimate *LINE* installer, targeting **Chinese-speaking users**; it attempts to weaken defenses by using PowerShell to add broad **Windows Defender exclusions**, performs sandbox checks (e.g., mutex/file-locking behaviors), and uses advanced injection (reported as **PoolParty Variant 7** via Windows I/O completion ports) to hide within trusted processes while stealing credentials and maintaining C2 communications.
Jun 29, 2026