PhantomVAI Loader Attacking Organizations Worldwide to Deliver AsyncRAT, XWorm, FormBook and DCRat
A multi-stage malware campaign is currently targeting organizations globally, utilizing the PhantomVAI Loader to distribute various information-stealing malware variants.
A multi-stage malware campaign is currently targeting organizations globally, utilizing the PhantomVAI Loader to distribute various information-stealing malware variants.
The attack sequence, initiated by phishing emails, poses a significant threat to sectors such as manufacturing, education, healthcare, technology, utilities, and government. The malware, initially known as Katz Stealer Loader, has evolved to deploy infostealers like AsyncRAT, XWorm, FormBook, and DCRat, enhancing its versatility.
The campaign begins with phishing emails containing malicious attachments disguised as legitimate business communications. These emails use social engineering tactics to entice recipients into opening archived JavaScript or VBS files.
Homograph attacks are employed, substituting Latin characters with similar-looking Unicode characters, to bypass email security filters.
The campaign begins with phishing emails containing malicious attachments disguised as legitimate business communications.
Following the phishing stage, multiple sophisticated layers of attack are employed. Malicious scripts, heavily obfuscated, contain Base64-encoded PowerShell commands that execute upon opening.
The PowerShell scripts download files disguised as images from attacker-controlled servers. These images use steganography to conceal the loader payload, embedding Base64-encoded DLL files within the image data.
Infection Mechanism and Evasion Techniques
Once the encoded text is extracted, a PowerShell script decodes and loads the PhantomVAI Loader DLL written in C#. It executes a method called VAI, performing virtual machine detection using system attributes to identify virtualization. If detected, the loader terminates.
The loader achieves persistence via scheduled tasks executing PowerShell commands or by creating Windows Registry Run keys. It downloads the final payload from a command-and-control server, injecting it into system processes using process hollowing, often targeting MSBuild.exe.
This approach allows the malware to remain undetected while executing its information-stealing operations.
Based on reporting by Cyber Security News.