Loading story…
Researchers linked multiple phishing-driven campaigns to HawkEye and related surveillance malware, describing a long-running credential-theft threat that targeted organizations across dozens of countries and industries. The malware was delivered through lures such as airline ticket confirmations and fake payment documents, often inside compressed archives or executable attachments, and was also tracked alongside the similar Predator Pain family. Victims included industrial, engineering, manufacturing, government, higher education, retail, telecommunications, and professional services organizations, with especially heavy targeting reported in the United States, Australia, Canada, parts of Asia, and the Middle East.
The malware acted as a feature-rich spyware and keylogger, stealing browser, email, messaging, and FTP credentials, capturing keystrokes, screenshots, clipboard data, and system information, and in some cases injecting into legitimate .NET binaries such as RegAsm.exe and vbc.exe. Investigators said stolen data was exfiltrated through SMTP email, HTTP, PHP web panels, and FTP, including periodic submissions to attacker-controlled mailboxes; one variant checked external connectivity and included the victim’s public IP address in exfiltration messages. Kaspersky also tied Hawkeye-based tooling to Operation Ghoul, a financially motivated spear-phishing operation that hit more than 130 organizations and used both malware delivery and phishing pages to harvest accounts.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
Cisco Talos observed sustained malspam campaigns in late 2018 and early 2019 distributing HawkEye Reborn v9 through malicious Office documents exploiting CVE-2017-11882. The campaigns used a heavily obfuscated AutoIT-based infection chain with process hollowing into RegAsm.exe and delivered a credential-stealing .NET payload.
Kaspersky reported another Operation Ghoul wave beginning on June 27, 2016. The attackers continued using spear-phishing emails and HawkEye-based malware to steal credentials, screenshots, keystrokes, and other data.
Kaspersky observed a new wave of Operation Ghoul spear-phishing attacks beginning on June 8, 2016. The campaign heavily targeted industrial, engineering, and manufacturing organizations, with many victims in the United Arab Emirates.
Unit 42 tracked Predator Pain and HawkEye activity during July through September 2015, describing widespread phishing-led surveillance malware campaigns targeting organizations in 80 countries. The report found email was the dominant delivery and exfiltration method, with activity peaking early in the workweek.
Kaspersky said artifacts from Operation Ghoul, including malware and attack-site evidence, showed the campaign had been active since March 2015. The campaign used malware based on commercial HawkEye spyware and targeted organizations for financial gain.
FortiGuard Labs analyzed a new HawkEye variant delivered through a phishing email posing as an airline ticket confirmation and packaged in a 7z archive. The malware used process injection into .NET binaries, logged keystrokes and clipboard data, and exfiltrated stolen information every 10 minutes via SMTP to a Yandex account.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 109 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcesecurelist.com
Open sourcefortinet.com
Open sourceblog.talosintelligence.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported active phishing operations using business-document lures and fake "secure mail" messages to infect Windows users with **VIP Keylogger** and related infostealers. Splunk said attackers sent payment notices, procurement orders, and logistics updates carrying heavily obfuscated `.vbs`, `.js`, or `.bat` loaders that launched PowerShell stagers, hid data in environment variables, and used steganography in PNG files to rebuild the final payload. K7 Labs also tracked a malware-as-a-service **VIP_Keylogger** campaign, while Splunk said the malware injects into `aspnet_compiler.exe` and steals keystrokes, screenshots, browser and Outlook credentials, clipboard contents, and cryptocurrency wallet addresses before exfiltrating data to attacker infrastructure, including Telegram. AhnLab separately detailed a South Korea-focused campaign impersonating a major credit card company with malicious LNK files that executed PowerShell and `mshta`, fetched an HTA with obfuscated VBScript, and displayed decoy documents to reduce suspicion. The malware changed behavior depending on whether Windows Defender was enabled: one path delivered AES-encrypted archives with backdoor, keylogging, clipboard theft, and information-stealing components, while the other used `rundll32` to load a downloader that avoided VBox and VMware and then pulled additional payloads from Google Drive to steal browser, email, cookie, clipboard, and cryptocurrency wallet data. Defenders were urged to scrutinize email attachments and file types, monitor suspicious registry and PowerShell activity, and watch for script-launched processes and Telegram-related DNS traffic.
Jun 29, 2026
Proofpoint and Splunk report renewed activity tied to **Phantom Stealer**, a Windows infostealer linked to the broader **Stealerium** malware family, as threat actors expand phishing and malicious-download campaigns aimed at harvesting identities and credentials. Proofpoint observed campaigns attributed to **TA2715** and **TA2536** using lures themed around payments, court summons, donations, travel, hospitality, and adult content, delivered through compressed executables, JavaScript, VBScript, ISO/IMG, and ACE attachments. The malware family, derived from an open-source .NET codebase, has proliferated into overlapping variants including Phantom and Warp Stealer. Once executed, Phantom Stealer collects browser credentials, cookies, autofill data, session tokens, FTP and SSH client secrets, email client data, VPN configurations, cryptocurrency wallet information, and other files from compromised Windows systems. Reported behaviors include application enumeration, access to browser SQLite stores such as `Login Data`, `Cookies`, and `Web Data`, unauthorized reads of WinSCP configuration folders, registry run key or scheduled-task persistence, Wi-Fi reconnaissance, PowerShell-based Windows Defender exclusions, and in some variants abuse of Chrome remote debugging to bypass browser protections and steal active sessions. Stolen data has been archived and exfiltrated through encrypted channels and services including SMTP, Discord webhooks, Telegram, and GoFile, increasing the risk of account takeover, fraud, and follow-on enterprise compromise.
Jul 13, 2026
A multi-stage phishing campaign is delivering **Phantom Stealer v3.5.0** through compressed archive attachments that contain obfuscated JavaScript, using shipment and tax-audit lures that impersonate trusted organizations including **UPS Forwarding Hub** and Malaysia’s **Inland Revenue Board (LHDN)**. After a victim opens the attachment, the JavaScript launches hidden PowerShell stages that decode and decrypt additional payloads with **AES** and **XOR**, keeping much of the activity in memory to reduce detection. The final payload is reflectively executed and injected into `aspnet_compiler.exe`, where it steals system information, browser credentials, cookies, payment card data, cryptocurrency wallet files, and messaging application data. The stolen information is then exfiltrated over authenticated **SMTP** on **TCP port 587** using **EHLO**, **STARTTLS**, and **AUTH LOGIN** with Base64-encoded credentials; researchers said they could not conclusively attribute the activity to a specific threat actor, noting that Phantom Stealer is broadly available in the cybercriminal ecosystem.
Jul 22, 2026