Phishing, Cracked Software and Discord Links Spread Phantom Stealer Across Multiple Countries

Phantom Stealer, a .NET-based information-stealing malware, is being distributed through phishing emails, pirated software downloads, and malicious links shared on Discord and Telegram.

The malware is designed to silently collect browser credentials, saved passwords, cookies, cryptocurrency wallet data, system details, and other sensitive information from infected Windows devices.

Security researchers have observed Phantom Stealer in campaigns targeting victims across several countries.

Its modular structure, flexible delivery methods, and strong focus on credential theft make it a growing concern for both individuals and organizations.

The malware is commonly delivered through phishing lures, trojanized applications, and malicious downloads that persuade users to launch an archive, script, or fake installer.

Phantom Stealer Global Campaign

Phantom Stealer uses multiple loaders to hide its final payload and reduce the chance of detection. One observed .NET loader conceals malicious content inside application resources, including PNG entries stored in a .NET resource manifest.

The embedded payload is encrypted and only revealed after the loader decrypts it on the victim’s system. This steganography-based method makes simple file inspection more difficult and can delay static malware analysis.

Another campaign used an obfuscated PowerShell script delivered through phishing email. The script dynamically compiled C# code, decoded shellcode, and injected it into explorer.exe, a legitimate Windows process.

By running inside a trusted process, the malware can blend into normal activity and make endpoint investigation more challenging. The loader also attempts to weaken security visibility.

Researchers found behavior associated with patching AMSI, which helps security tools inspect scripts and memory content, and ETW, a Windows telemetry mechanism widely used by monitoring and EDR products.

Disabling or modifying these functions can reduce the security logs available to defenders. Phantom Stealer further checks whether it is running inside a virtual machine, sandbox, or automated analysis environment.

It examines details such as usernames, computer names, running processes, services, GPU names, machine GUIDs, and IP addresses.

For example, references to VirtualBox, VMware, or known sandbox artifacts may cause the malware to stop or alter execution.

It also uses a timing check to identify environments that skip or accelerate sleep functions. Although the measured delay is very short, the purpose is clear: detect analysis systems designed to run malware faster than a normal user device.

Once active, Phantom Stealer targets a broad range of data sources. It collects usernames, passwords, cookies, stored payment-card details, autofill data, and session tokens from Chromium- and Gecko-based browsers, splunk said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR