New fileless stealer (Phantom Stealer) coming in through fake "request for quote" emails.

Phantom Stealer is a .NET-based fileless infostealer malware distributed via phishing emails containing fake business document attachments. It runs entirely in memory by injecting into trusted Windows processes, evading signature-based antivirus detection. The malware steals saved passwords, session cookies, financial data, cryptocurrency wallets, keystrokes, screenshots, and clipboard contents, then exfiltrates data through multiple channels. Usual defenses like MFA and password resets do not prevent compromise due to session cookie theft and persistence mechanisms. Detection relies on behavior-based monitoring and user training to recognize suspicious email attachments and scripts. Remediation requires isolating infected endpoints, revoking active sessions, resetting credentials, and hunting for persistence. The threat is actively used by multiple criminal groups targeting various industries including banks and logistics.

• kindssecurity.com/blog/what-is-phantom-stealer-and-how-does-it-spread (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1u8iai1/new_fileless_stealer_phantom_stealer_coming_in/ (opens in a new tab)