Phantom Stealer Targeting Users to Steal Sensitive Data
Phantom, a sophisticated malware variant, is executing targeted attacks to extract sensitive data from compromised systems. This includes passwords, browser cookies, credit card details, and cryptocurrency wallet credentials.
Phantom, a sophisticated malware variant, is executing targeted attacks to extract sensitive data from compromised systems. This includes passwords, browser cookies, credit card details, and cryptocurrency wallet credentials.
Security researchers have identified Version 3.5 of Phantom, which employs a complex multi-stage infection chain and advanced evasion techniques to bypass security measures and obtain personally identifiable information.
The malware initiates its attack through a deceptive file disguised as "Adobe 11.7.7 installer," first detected on VirusTotal on October 29, 2025. Upon execution, it utilizes an obfuscated XML file with embedded JavaScript to commence a sophisticated infection process.
The malware connects to a remote command server to download a PowerShell script named "floor.ps1," which executes with hidden attributes while bypassing PowerShell execution policy. This circumvents user warnings and security prompts.
Operational Mechanics of Phantom Stealer
The downloaded PowerShell script contains RC4-encrypted payloads that, upon decryption, reveal a malicious .NET assembly called "BLACKHAWK.dll." This DLL uses process injection techniques to load the stealer payload directly into the memory of the legitimate Windows executable "Aspnet_compiler.exe."
Phantom, a sophisticated malware variant, is executing targeted attacks to extract sensitive data from compromised systems.
Phantom leverages .NET Common Language Runtime's AppDomain isolation to avoid traditional endpoint detection mechanisms that rely on file-based indicators.
The malware exhibits extensive data extraction abilities. It systematically collects browser credentials, cookies, and autofill data from Chromium-based browsers such as Chrome and Edge. It also extracts AES master keys used for browser data encryption, enabling the decryption of stored passwords and payment information. Furthermore, Phantom captures cryptocurrency wallet credentials, desktop wallet data, and Discord account information.
In addition to browser-based data theft, Phantom incorporates comprehensive surveillance functionalities, including keylogging capabilities that capture user keystrokes. It harvests Wi-Fi credentials, Outlook email data with timestamps and computer identifiers, and system information such as hardware details and network configuration.
Phantom employs multiple advanced evasion techniques to escape security analysis and monitoring. It performs anti-analysis checks by matching usernames against a list of known sandbox and analyst usernames. Upon detection, the malware activates a self-destruct mechanism to terminate its process and erase traces from the system.
Critically, Phantom uses "Heaven's Gate," a technique for x86-to-x64 mode switching, allowing the malware to execute 64-bit code from a 32-bit process. This technique bypasses x86-specific user-mode hooks used by security software, enabling Phantom to evade 32-bit monitoring tools.
The malware transmits stolen data through various channels, including SMTP, FTP, Telegram, and Discord. Hardcoded SMTP credentials, stored in base64 format, facilitate direct email transmission of exfiltrated data.
Security experts advise using reputable endpoint protection solutions, ensuring operating systems are up-to-date, and practicing good cyber hygiene, such as verifying software authenticity before downloading. Users should exercise caution with unfamiliar files and consider using sandbox environments for suspicious executables before running them on production systems.
Based on reporting by GBHackers.