PhantomStealer

PhantomStealer is a Windows C#/.NET information stealer, including version 3.5.0 builds marketed through a malware-as-a-service ecosystem. It has been deployed in phishing and malspam campaigns using business-oriented invoice, quotation, order, shipping, and procurement lures, with observed targeting of Italian organizations as well as maritime, industrial supply-chain, procurement, and accounts-receivable personnel. Campaigns commonly use heavily obfuscated JavaScript or JScript droppers that invoke PowerShell, decrypt and reflectively load .NET stages in memory, and inject the final payload into legitimate .NET processes through process hollowing. Some deployments also use a vulnerable-driver-based injector to disable endpoint security products before launching the stealer.

PhantomStealer harvests stored browser credentials, cookies, autofill and payment-card data from Chromium- and Gecko-based browsers; it also collects browser-extension and desktop cryptocurrency-wallet data, email-client profiles, FTP and remote-access client credentials, messaging artifacts, saved Wi-Fi credentials, clipboard content, selected local files, and host and network information. Builds may support keylogging and screenshot capture. Its crypto-clipper module can replace copied cryptocurrency wallet addresses with operator-controlled addresses. Collected data has been exfiltrated through SMTP, FTP, or the Telegram Bot API, depending on build configuration.

The malware includes configurable persistence, anti-analysis, and self-deletion functionality, though these features are disabled in some observed builds. Persistence mechanisms include startup shortcuts, Registry Run entries, and monitoring intended to relaunch terminated payloads. PhantomStealer is associated with the PhantomCore actor’s tooling ecosystem and has also been linked to a commercially promoted PhantomStealer MaaS operation.