Phantom Stealer

Key Takeaways

• Credential and Data Theft: Phantom Stealer targets browser passwords, session cookies, payment information, cryptocurrency wallets, and other sensitive data.
• Windows-Focused Threat: The malware is designed to compromise Windows endpoints and can interact with browsers and applications installed on the victim's system.
• MaaS Distribution: Phantom Stealer is commercially offered as a Malware-as-a-Service product, allowing multiple threat actors to deploy it in different campaigns.
• Phishing Delivery: Recent campaigns have used business-themed phishing emails and compressed attachments to deliver the stealer.
• Evasion-Focused Execution: Variants use obfuscation, PowerShell, process injection, and in-memory execution to reduce the visibility of the payload.
• Multiple Exfiltration Channels: Stolen information can be sent through channels including Telegram, Discord, SMTP, and FTP.
• ANY.RUN’s Interactive Sandbox analysis shows Phantom Stealer harvesting browser credentials, session cookies, financial data, and other sensitive information, while using in-memory execution and process injection to evade detection.

What is Phantom Stealer?

Phantom Stealer is a commercially distributed Windows infostealer built to collect valuable information from compromised systems. It targets major web browsers, including Chrome, Firefox, and Edge, harvesting credentials, cookies, payment information, and other browser data.

The malware can also collect cryptocurrency wallet information, screenshots, clipboard contents, keystrokes, system information, and data associated with applications such as Discord, Telegram, and Steam.
Phantom Stealer is offered through a subscription-based Malware-as-a-Service model, lowering the technical barrier for threat actors who want to conduct credential theft and information-stealing campaigns. Recent reporting attributes the operation to an actor using the alias Oldphantomoftheopera and the Phantom Softwares group.

How Phantom Stealer Threatens Businesses and Organizations

A successful Phantom Stealer infection can expose organizations to risks beyond the initial endpoint compromise:

• Account takeover: Stolen browser passwords and session cookies can provide access to corporate accounts and web applications.
• Financial loss: Payment information and cryptocurrency wallet data can be targeted for direct financial theft.
• Credential exposure: Browser-stored credentials can include access to email, SaaS platforms, administrative portals, and other business services.
• Session hijacking: Stolen cookies and authentication data may allow attackers to reuse existing authenticated sessions.
• Follow-on attacks: Compromised credentials can provide attackers with additional opportunities for phishing, fraud, and further intrusion.
• Data exposure: Screenshots, clipboard contents, application data, and system information can reveal additional sensitive information.

Victimology: Who Is Most Vulnerable?

Phantom Stealer can affect organizations across industries because its primary targets — browser credentials, cookies, financial information, and application data — are commonly present on Windows workstations. Recent campaigns have particularly used business-themed phishing lures, including documents and quote-request themes, suggesting targeting of corporate environments.
The MaaS model also means that Phantom Stealer should not be associated with a single victim profile or threat actor. Different operators can deploy the same malware through their own phishing infrastructure and delivery chains.

How Does Phantom Stealer Function?

Observing a Phantom Stealer sample inside ANY.RUN’s Interactive Sandbox reveals a multi-stage infection chain designed to move from phishing delivery to in-memory payload execution and data exfiltration.

The infection chain begins with wscript.exe acting as a launcher and progresses through WMI, hidden PowerShell execution, remote payload retrieval, in-memory loading, and browser targeting.

Phantom Stealer detonated inside ANY.RUN’s Interactive Sandbox

Stage 1: JavaScript Loader

The infection begins with shim.js, a JavaScript loader executed through wscript.exe. Rather than launching the main payload directly, the script uses WMI to create a hidden PowerShell process.

The observed execution chain is:

JS loader → WMI → PowerShell → remote payload → PE payload

This approach keeps the primary payload separate from the initial JavaScript file and allows the next stages to be retrieved and executed dynamically.

wscript.exe launching the Phantom Stealer JavaScript loader

Stage 2: Hidden PowerShell Execution

The WMI-created PowerShell process runs with several parameters designed to limit visibility and restrictions:

• -ExecutionPolicy Bypass bypasses the standard PowerShell execution policy.
• -NoProfile prevents user PowerShell profiles from affecting execution.
• -WindowStyle Hidden keeps the PowerShell window invisible.

The script then retrieves code from the INTERNAL_DB_CACHE user environment variable and executes it using IEX (Invoke-Expression). Afterward, the variable is deleted, removing the stored value from the user environment.

PowerShell running in hidden mode

Stage 3: Remote Payload Retrieval

The PowerShell stage creates a .NET WebClient and uses DownloadData() to retrieve data from a remote resource over HTTPS.

The downloaded object is presented as a PNG file, allowing the next-stage payload to appear as a legitimate image resource rather than an executable.

PowerShell downloading the second-stage payload via .NET WebClient

Stage 4: Payload Decoding

The downloaded bytes are converted into a string and passed through FromBase64String(). The resulting data begins with the MZ signature associated with Windows PE files.

The observed chain is therefore:

HTTPS request → PNG-like data → byte array → Base64 decoding → PE payload

The presence of XICC_PROFILE within the downloaded data further supports the use of image data as a container for the next stage.

PNG file used to deliver the next-stage payload

Stage 5: In-Memory Loading

Rather than simply writing the decoded executable to disk, the payload is loaded from a byte array using .NET's Load(System.Byte[]). This allows the PE/.NET assembly to be loaded directly into memory, reducing the need for a conventional executable file on disk and making the execution chain harder to detect through file-based analysis alone.

Stage 6: Phantom Process and Browser Targeting

Following the loader activity, AddInProcess32.exe appears in the process tree and is associated with the Phantom payload. The use of a legitimate Windows/.NET component name can make the process appear less suspicious when viewed by name alone.

The process subsequently launches separate instances of:

• chrome.exe
• firefox.exe
• msedge.exe

Each browser is started with its own temporary profile directories. This behavior is consistent with Phantom Stealer's focus on browser environments and provides the malware with access to browser-related authentication and account data.

Overall, the analyzed execution chain combines WMI-based process creation, hidden PowerShell, remote payload retrieval, encoded delivery, in-memory loading, and browser interaction to conceal the stealer and reach its primary data sources.

The Evolution of Phantom Stealer

Phantom Stealer has appeared in multiple variants and delivery chains, with recent campaigns placing significant emphasis on stealth and in-memory execution.

• Commercial distribution: Phantom Stealer is offered through a MaaS model, allowing different operators to deploy the malware.
• Multi-stage delivery: Campaigns use layered scripts, loaders, and decoding mechanisms to conceal the final payload.
• Improved evasion: Recent activity has incorporated process injection and in-memory execution to reduce traditional file-based detection opportunities.
• Expanded targeting: The malware targets not only browser credentials but also cryptocurrency wallets, financial data, messaging applications, screenshots, and clipboard contents.
• Flexible exfiltration: Operators can use multiple communication channels to retrieve stolen information.

How Businesses Can Use ANY.RUN’s Threat Intelligence Against Phantom Stealer

Phantom Stealer uses multi-stage delivery and changing infrastructure, making isolated IOCs insufficient for tracking the threat. ANY.RUN’s Threat Intelligence helps SOC teams correlate known indicators with related samples, infrastructure, and recurring behavioral patterns.

Threat Intelligence Lookup allows analysts to investigate Phantom Stealer activity and uncover related artifacts beyond a single suspicious sample.

threatName:"phantomstealer"

TI Lookup shows that PhantomStealer targets manufacturing and telecoms companies in the EU

Detect Beyond Static IOCs

Defenders should combine traditional indicators with behavioral detections. Useful signals associated with Phantom Stealer activity include:

• Suspicious business-themed phishing attachments
• RAR archives containing BAT or script files
• Heavily obfuscated batch or PowerShell commands
• Large encoded PowerShell payloads
• Unexpected PowerShell activity originating from user-opened documents or archives
• Process injection into legitimate Windows processes
• Browser processes launched with unusual command-line arguments
• Unexpected access to browser credential and cookie stores
• Connections to Telegram, Discord, FTP, or SMTP infrastructure from unusual processes
• Attempts to access cryptocurrency wallet files or extensions

Behavior-based detection is particularly valuable because Phantom Stealer is commercially distributed and its infrastructure can change between campaigns.

Fresh ANY.RUN’s Threat Intelligence Feeds enriched by data from 16,000 organizations and 700,000 security professionals, provide SOC teams with up-to-date indicators of Phantom Stealer activity. These feeds can be integrated with SIEM, SOAR, and EDR platforms, and other security controls to help identify malicious infrastructure and maintain visibility as the threat evolves.

High-confidence IOCs powered by data from 16K SOCs and 700K analysts

Connect Individual Samples to the Wider Campaign

Analysts can use ANY.RUN’s Threat Intelligence Lookup to trace Phantom Stealer indicators across related samples, infrastructure, and historical sandbox activity.

For example, a suspicious batch file can be investigated alongside:

• Related Phantom Stealer samples
• Shared hashes or code characteristics
• Associated command-and-control infrastructure
• Similar PowerShell loaders
• Common persistence mechanisms
• Related phishing attachments
• Previous sandbox executions

This approach helps analysts identify campaign relationships that may not be visible from a single IOC.

Respond to Phantom Stealer Infections

If Phantom Stealer is confirmed on a corporate endpoint, incident response should focus on both the infected system and the credentials that may have been exposed.

Recommended actions include:

• Isolate the affected endpoint.
• Reset credentials stored or used on the compromised system.
• Revoke active sessions where supported.
• Investigate authentication activity for suspicious logins.
• Review browser-stored credentials and corporate password-manager access.
• Monitor cryptocurrency wallets and financial accounts if applicable.
• Search the environment for related malware, infrastructure, and persistence mechanisms.
• Preserve forensic evidence before rebuilding the affected endpoint.

Because Phantom Stealer can steal session cookies in addition to passwords, simply changing a password may not remove every form of attacker access.

Conclusion

Phantom Stealer illustrates the growing accessibility of information theft through the Malware-as-a-Service model. By combining broad data collection with phishing-based delivery, obfuscation, process injection, and in-memory execution, the malware can turn a single compromised Windows endpoint into a source of credentials, session data, financial information, and other sensitive assets.

For defenders, detecting Phantom Stealer requires more than blocking known hashes and domains. Behavioral monitoring, interactive malware analysis, endpoint telemetry, and threat intelligence correlation can help identify both individual infections and the broader campaigns behind them.

Frequently Asked Questions: Phantom Stealer

1. What is Phantom Stealer?

Phantom Stealer is a Windows-focused Malware-as-a-Service infostealer designed to harvest credentials, cookies, financial information, cryptocurrency wallets, and other sensitive data.

2. What does Phantom Stealer steal?

Phantom Stealer can target browser passwords, cookies, payment information, cryptocurrency wallets, screenshots, clipboard contents, keystrokes, system information, and data from applications such as Discord, Telegram, and Steam.

3. How is Phantom Stealer delivered?

Recent campaigns have used phishing emails containing compressed archives and malicious scripts or executables disguised as legitimate business documents.

4. How does Phantom Stealer evade detection?

Variants use obfuscation, PowerShell loaders, process injection, and in-memory execution. Some recent campaigns have injected the payload into legitimate processes such as explorer.exe.

5. How can organizations use interactive sandboxing and threat intelligence to detect Phantom Stealer?

Interactive sandboxing allows analysts to observe Phantom Stealer’s execution chain in real time, including wscript.exe launching a JavaScript loader, WMI activity, hidden PowerShell execution, remote payload retrieval, in-memory loading, and browser targeting. Proactive threat intelligence can then help pivot from observed indicators to related samples, infrastructure, and previous Phantom Stealer activity.