This threat involves a phishing campaign where attackers send emails impersonating sales staff, containing malicious GZ compressed files. Upon extraction, an injector executable is delivered that employs multiple UAC bypass methods such as SSPI-based authentication and CMSTPLUA COM exploitation to gain elevated privileges. It performs Bring Your Own Vulnerable Driver (BYOVD) attacks using the vulnerable DCRCVDrv.sys driver to terminate security products via kernel-level access. After neutralizing security software, the injector uses process hollowing to inject PhantomStealer malware into the legitimate AddInProcess32.exe process. PhantomStealer then conducts comprehensive data theft activities including keylogging, screen capture, stealing browser credentials, cryptocurrency wallet data, and clipboard manipulation to replace wallet addresses with those controlled by the attacker.

The campaign enables attackers to bypass User Account Control (UAC) and disable security products at the kernel level, allowing PhantomStealer to operate undetected. The malware steals sensitive information such as keystrokes, screenshots, browser credentials, and cryptocurrency wallet data. Clipboard manipulation to replace wallet addresses poses a direct financial theft risk to victims. This results in significant confidentiality breaches and potential financial losses.

No official patch or remediation is indicated for this threat. Since it involves social engineering via phishing emails, user awareness and email filtering are primary defenses. Endpoint security solutions should be updated to detect and block the known injector and PhantomStealer malware. Monitoring for the listed indicators of compromise (domains, hashes, URLs) can aid detection. Because the attack exploits a vulnerable driver (DCRCVDrv.sys), ensuring that systems do not have vulnerable drivers installed or are updated to versions without this vulnerability may reduce risk. However, patch status for the driver vulnerability is not confirmed; check vendor advisories for updates.