Researchers have identified a new variant of the data-stealing malware, Phantom Stealer version 3.5, capable of harvesting a wide range of sensitive user data, including passwords, browser cookies, credit card information, crypto wallet credentials, and other personal details.
The campaign was first observed when a fake file disguised as “Adobe 11.7.7 installer” was uploaded to VirusTotal on October 29, 2025.
Analysis revealed that the file was not a legitimate installer but an obfuscated XML file containing embedded JavaScript code.
Once executed, the script connects to a remote server at hxxp[:]//positivepay-messages[.]com/file/floor[.]ps1 to download an additional PowerShell script named floor.ps1, which runs in hidden mode while bypassing PowerShell’s security prompts.
The PowerShell script contains an RC4-encrypted payload, which is later decrypted using a base64-encoded key.
The decrypted content loads the .NET dynamic link library BLACKHAWK.dll using the System.Reflection.Assembly::Load method a common technique used by malware to evade detection.
This DLL acts as an injector, embedding another executable, identified as the primary Phantom Stealer payload, into the memory of a legitimate Windows process, Aspnet_compiler.exe.
The injection is performed using Windows API functions such as WriteProcessMemory and VirtualAllocEx, enabling the malicious code to execute covertly within a trusted process.
Data Exfiltration and Advanced Evasion Techniques
Upon successful execution, Phantom Stealer v3.5 employs extensive anti-analysis and self-deletion techniques.
It checks for debugging tools, sandbox names, and virtualized environments, and if any are detected, the malware triggers a function called “Melt” to remove itself from the System. For persistence, it creates a registry run entry to restart automatically on each boot.
The decrypted payload demonstrates highly targeted espionage behavior; it extracts encryption master keys from Chromium-based browsers, decrypts saved passwords and credit card data, and retrieves credentials from applications such as Discord, FileZilla, Foxmail, and Outlook.
It also gathers Wi-Fi passwords, system information, and browser wallet keys while capturing screenshots every second and logging keystrokes to monitor user activity in real time.
For exfiltration, the stealer uses multiple communication channels, including SMTP, FTP, Discord, and Telegram.
The SMTP routine relies on hardcoded, base64-encoded credentials that are decoded and used to transmit the stolen data to remote attacker-controlled servers.
Phantom 3.5 also employs the advanced Heaven’s Gate evasion technique, enabling a 32-bit process running under WOW64 to switch to 64-bit execution, effectively bypassing 32-bit security hooks and monitoring tools.
According to the malware’s infection chain and modular design, it is both stealthy and persistent.
K7 Security Labs experts recommend that users avoid downloading software from unverified sources, maintain good cyber hygiene, and rely on trusted antivirus solutions to prevent such infections.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
