Loading story…
Proofpoint and Splunk report renewed activity tied to Phantom Stealer, a Windows infostealer linked to the broader Stealerium malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to TA2715 and TA2536 using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer.
Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as Login Data, Cookies, and Web Data, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Splunk documented Phantom Stealer as an infostealer targeting browser data, FTP and SSH clients, email clients, cryptocurrency wallets, and VPN configurations, and highlighted behavioral detections such as browser database access, WinSCP folder reads, and registry run key persistence.
Proofpoint observed renewed Stealerium activity beginning in May 2025, including campaigns it attributed to TA2715 and TA2536 using varied phishing lures and attachment types.
Proofpoint reports that Stealerium had only limited presence in its email threat telemetry beginning in early 2023 before later activity increased.
Proofpoint says the open-source .NET infostealer Stealerium appeared on GitHub in 2022, after which multiple closely related variants proliferated, including Phantom Stealer and Warp Stealer.
Proofpoint published new technical details on Stealerium-linked campaigns, including post-execution Wi-Fi reconnaissance, Defender exclusion changes, scheduled-task persistence, Chrome remote debugging abuse, and multiple exfiltration channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
PhantomStealer v3.5.0 was deployed in multiple phishing campaigns using invoice, RFQ, maritime, and industrial lures delivered as heavily obfuscated JavaScript droppers. Across the observed samples, the malware followed a consistent multi-stage chain: Windows Script Host launched PowerShell, decrypted additional payloads, reflectively loaded .NET components, and hollowed the signed Microsoft binary `Aspnet_compiler.exe` to run the final infostealer. Researchers tied the activity to the PhantomStealer malware-as-a-service ecosystem advertised via `phantomsoftwares.site` and the Telegram identity **Oldphantomoftheopera**, with builder-generated samples showing per-build customization but a stable framework, anti-analysis logic, and optional persistence. The payloads stole browser credentials, cookies, credit cards, email and messaging data, Wi-Fi passwords, screenshots, keystrokes, and cryptocurrency wallet information, while some builds also enabled a crypto clipper that replaced wallet addresses across multiple chains. The campaigns abused legitimate but compromised infrastructure for both delivery and exfiltration, including a Portuguese theater website hosting encrypted PowerShell stages, a Chilean mail server and a Malaysian business email account used as SMTP relays, and Romanian FTP hosting used by another PhantomStealer build. Exfiltration varied by sample—SMTP to attacker mailboxes at `graceishere.tech`, Telegram Bot API, Discord, or FTP—but infrastructure overlap repeatedly linked the deployments back to the same MaaS operation, and one report also connected a PhantomStealer FTP campaign to related AgentTesla activity through shared submissions and tooling. The targeting and lure themes indicate a focus on procurement, shipping, maritime, industrial, and accounts receivable personnel, while the repeated use of compromised SMB hosting and mail systems suggests operators favored hijacked third-party services over dedicated attacker-owned infrastructure.
Jun 29, 2026
Multiple reports describe **active malware campaigns targeting Windows users** with a focus on **credential, session, and wallet theft** delivered through social engineering and abuse of legitimate services. **CharlieKirk Grabber**, a Python infostealer packaged with *PyInstaller*, is distributed via phishing, cracked software, cheats, and social-media lures; it kills browser processes (via `TASKKILL`) to access credential stores, collects passwords/cookies/autofill/Wi‑Fi data, zips the loot, uploads it to *GoFile*, and relays the download link to operators via **Discord webhooks** or **Telegram bots**. Separately, attackers are buying **Facebook ads** impersonating Microsoft to drive victims to cloned Windows 11 download pages on lookalike domains (e.g., `ms-25h2-update[.]pro`), delivering a malicious installer that steals saved passwords, browser sessions, and **cryptocurrency wallet** data; the campaign uses **geofencing/sandbox evasion** to show benign content to data-center IPs while serving malware to likely end users. Other contemporaneous activity highlights broader Windows-targeted intrusion tradecraft and adjacent threats. FortiGuard Labs reported **Winos 4.0 (ValleyRat)** phishing campaigns in Taiwan using tax and e-invoice lures, with delivery chains including malicious **LNK** downloaders, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud hosting. In LATAM, a fake bank-receipt lure delivers **XWorm v5.6** via a `.pdf.js` double-extension WSH dropper that uses junk-padding and Unicode obfuscation, then reconstructs and runs PowerShell (spawned via WMI) and abuses trusted hosting (e.g., Cloudinary) for later stages—enabling credential theft and potential ransomware follow-on. Additional reporting covered a USB-propagating **Monero cryptomining** operation capable of crossing air-gapped environments, a new Linux **SysUpdate** variant with encrypted C2 traffic (and a Unicorn Engine-based decryption approach developed during DFIR), and the **Foxveil** loader abusing **Cloudflare Pages, Netlify, and Discord** to stage shellcode and persist via services or *SysWOW64* masquerading—these are separate threats but reinforce the trend of attackers blending into trusted infrastructure and common user workflows.
Jun 29, 2026
Researchers detailed multiple credential-theft threats targeting browsers, wallets, messaging apps, and copied secrets. **Stealc**, a malware-as-a-service infostealer marketed on Russian-speaking forums, was shown stealing browser credentials, cookies, autofill data, payment cards, cryptocurrency wallet extensions and files, Discord tokens, Telegram sessions, Steam files, Outlook credentials, and screenshots, while using anti-analysis checks, RC4-protected configuration data, and HTTP-based command-and-control to exfiltrate data and fetch second-stage payloads. Separately, Threatray linked the Rust-based Windows stealer **KuinaExtractor** to its newer **k0to** branding, finding the same malware family behind builds that steal browser data, saved credentials, gaming sessions, crypto-wallet data, Discord tokens, Windows Credential Manager data, and Wi-Fi details, while adding privilege-escalation attempts, Microsoft Defender tampering, and stronger concealment. A parallel browser-based campaign used malicious updates to the Chrome extension **"VPN Go: Free VPN"** and the Firefox extension **"Free VPN by VPN GO"** to capture clipboard contents and send them to hardcoded HTTP endpoints. Because the extensions still provided visible VPN or proxy functionality, the clipboard theft was harder for users to spot, putting copied passwords, MFA recovery codes, seed phrases, API keys, OAuth tokens, and banking details at risk. The reports advised organizations to remove the extensions, review synced browser profiles, revoke sessions, rotate exposed credentials and secrets from a clean device, and treat any Windows system that executed the stealers as a full infostealer compromise.
Jul 7, 2026