PhantomVAI Custom Loader Uses RunPE Utility to Attack Users
A sophisticated malware loader named PhantomVAI has been identified in global phishing campaigns, distributing various stealers and remote access trojans (RATs) to affected systems.
A sophisticated malware loader named PhantomVAI has been identified in global phishing campaigns, distributing various stealers and remote access trojans (RATs) to affected systems.
This loader disguises itself as legitimate software and uses process hollowing techniques to inject malicious payloads into Windows processes.
Security researchers from multiple organizations have documented this threat under different names, leading to some confusion regarding its identity and capabilities. The loader targets users worldwide via phishing lures embedded in malicious email attachments and links.
Upon execution, PhantomVAI downloads remote payloads and injects them into legitimate Windows processes, complicating detection efforts.
The malware has been linked to delivering threats such as Remcos , XWorm, AsyncRAT, DarkCloud, and SmokeLoader across different regions.
Analysts from Intrinsec identified that multiple security vendors have documented this loader independently, assigning names like VMDetectLoader and Caminho Loader to the same threat. This inconsistency arises from organizations analyzing different components of the loader separately.
This loader disguises itself as legitimate software and uses process hollowing techniques to inject malicious payloads into Windows processes.
All instances share certain characteristics: the presence of a "VAI" method, Portuguese code strings, and the use of "Microsoft.Win32.TaskScheduler.dll" based on a legitimate GitHub project.
Technical Architecture and Execution Flow
The loader's core function relies on a RunPE utility called "Mandark," developed by HackForums user "gigajew" and open-sourced several years ago.
This utility conducts process hollowing by creating a suspended legitimate process, unmapping its memory, and injecting malicious code. The namespace "hackforums.gigajew" in the loader's code confirms this link to the original utility.
PhantomVAI specifically exploits version 2.11.0.0 of the legitimate Microsoft Windows Task Scheduler library.
The malware extracts fields from the downloaded payload's header, including image size, header size, entry point, and base address. It then initiates a host process, allocates memory with read/write/execute permissions, and copies PE headers and sections into the allocated memory.
The loader adjusts processor registers to ensure correct import resolution and relocation before resuming the thread to execute the malicious payload.
The threat operates under a suspected loader-as-a-service model , allowing multiple threat actors to use the same infrastructure for different malicious campaigns, contributing to its widespread nature globally.
Based on reporting by Cyber Security News.