A multi-stage phishing campaign impersonates legitimate business entities to deliver Phantom Stealer v3.5.0. Initial infection vectors are emails with compressed archives containing malicious JavaScript files. Execution of these files launches obfuscated PowerShell scripts that operate solely in memory, deploying encrypted and encoded payloads through Base64 encoding, AES encryption, and XOR ciphering. The final payload harvests sensitive credentials and system information before exfiltrating data over SMTP port 587 using STARTTLS. The attack uses reflective code loading and process injection to evade detection and minimize disk artifacts. This campaign targets victims primarily in Malaysia and leverages trusted business workflows to increase success rates.

The Phantom Stealer malware harvests credentials from web browsers, cryptocurrency wallets, messaging applications, and collects system information. Stolen data is exfiltrated securely via SMTP with STARTTLS encryption, potentially leading to credential compromise, financial theft, and unauthorized access to victim systems. The multi-stage, in-memory execution and process injection techniques reduce detection likelihood by traditional security solutions, increasing the risk of prolonged undetected compromise.

No official patch or remediation is available as this is a malware campaign rather than a software vulnerability. Defenders should focus on user awareness to recognize phishing attempts impersonating trusted business entities. Endpoint detection solutions should be tuned to detect behaviors such as in-memory PowerShell execution, reflective code loading, process injection, and suspicious SMTP traffic on port 587. Network monitoring for anomalous SMTP exfiltration and blocking or quarantining suspicious compressed email attachments can help reduce risk. Since the malware operates primarily in memory and uses obfuscation, behavior-based detection is critical.