Phantom Stealer Campaign Abuses UPS and Tax Audit Emails to Steal Credentials

A multi-stage phishing campaign that impersonates trusted business communications, including a global logistics provider and a government tax authority, to deploy Phantom Stealer v3.5.0, a credential-harvesting malware that exfiltrates data via SMTP.

Documented by Seqrite, the campaign uses two distinct phishing lures sharing an identical infection chain. The first impersonates UPS Forwarding Hub, presenting fake shipment booking and quotation details to target procurement teams.

The second poses as an official notice from Malaysia’s Inland Revenue Board (LHDN), written in Malay, demanding tax audit documentation within a 14-day deadline to pressure finance staff.

Both emails deliver a malicious JavaScript file inside a compressed archive, disguised with business-relevant filenames like “UPS Docs_Shipment Number 3264010420-Quote ID 203263067.js” to appear legitimate.

Phantom Stealer Campaign

The attack unfolds in four stages:

• Stage 1 (JavaScript): The obfuscated script uses numeric string-array indexing to hide function calls. It embeds a large Base64-encoded PowerShell payload directly in its source, decodes it via native Windows COM objects, and executes it through a hidden PowerShell process avoiding external downloads entirely.
• Stage 2 (PowerShell Loader1): This stage stores the next payload as AES-encrypted data (CBC mode, PKCS7 padding) with the key and IV embedded as Base64 strings. Decryption happens entirely in memory using .NET’s AesCryptoServiceProvider, and the result executes via Invoke-Expression.
• Stage 3 (PowerShell Loader2): This loader carries two payloads: an XOR-encrypted .NET injector (key: “DEVILboy56@@”) and a raw decimal byte array that decodes to a valid PE file (confirmed via the “MZ” header). The PE is passed directly to the injector alongside the legitimate aspnet_compiler.exe process for reflective, in-memory execution.
• Stage 4 (Phantom Stealer v3.5.0): The final payload harvests browser credentials, cookies, saved payment cards, cryptocurrency wallet data, and messaging app files, sorting them into categorized files (e.g., Chromium_passwords_<hostname>.txt).

Phantom Stealer authenticates to an SMTP server over port 587 using Base64-encoded AUTH LOGIN credentials, observed as ruhi@aktekmetal[.]com[.]tr.

It upgrades the connection with STARTTLS for encrypted transit, sends stolen data as separate files by category, then cleanly terminates with a QUIT command mimicking legitimate outbound email traffic to evade detection.

No specific threat actor has been conclusively linked to this campaign. Phantom Stealer is a commodity malware widely circulated in cybercriminal markets and used by multiple operators.

This campaign underscores how attackers combine convincing business pretexts with layered obfuscation and fileless execution to slip past traditional defenses.

Organizations should scrutinize unexpected shipment or tax-related attachments, restrict script execution, monitor for reflective loading and process injection, and flag anomalous outbound SMTP traffic as part of a broader defense-in-depth strategy.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.