Phantom Stealer, a .NET-based malware targeting Windows devices, has been detected in phishing emails, pirated software downloads, and malicious links on Discord and Telegram This article explores applications malicious. . It silently collects sensitive information such as browser credentials, saved passwords, cookies, cryptocurrency wallet data, system details, and more from infected machines.
Its modular design, flexible delivery methods, and focus on credential theft make it a growing threat for both individuals and organizations. The malware is commonly delivered through phishing lures, trojanized applications, and malicious downloads that trick users into launching an archive, script, or fake installer. Phantom Stealer Global Campaign Phantom Stealer employs multiple loaders to conceal its final payload, thereby reducing detection chances.
One notable .NET loader hides malicious content within application resources, including PNG entries in a .NET resource manifest. Researchers found behavior associated with patching AMSI, which helps security tools inspect scripts and memory content, and ETW, a Windows telemetry mechanism widely used by monitoring and EDR products. Phantom Stealer verifies it's operating within virtual machines, sandboxes, or automated analysis setups by scrutinizing details like usernames, computer names, running processes, services, GPU identifiers, machine GUIDs, and IP addresses.
