Phantom

Phantom is a malware name used for multiple unrelated threats, but the strongest malware-specific evidence here supports Phantom as a Windows information stealer. It has been observed delivered by fake Adobe update or installer lures and is associated with social-engineering-driven infection chains. Reported behavior includes theft of sensitive user data and exfiltration of stolen information over SMTP. Phantom has also been referenced alongside other commodity stealers in criminal distribution ecosystems and has been used as a payload delivered by other malware loaders. Separately, the name Phantom has also been used in public reporting for an NSO Group phone-hacking product described as functionally aligned with Pegasus and marketed to U.S. government customers, but that usage refers to a mercenary spyware platform rather than the commodity infostealer activity most directly supported for this malware entry. Because the same name is applied to distinct tools, attribution, platforming, and capability claims beyond the stealer activity should be treated cautiously unless further disambiguated.