Threats Tagged 'powershell obfuscation'

This threat describes a sophisticated phishing campaign distributing Phantom Stealer v3.5.0 by impersonating trusted business entities such as UPS and the Malaysian Inland Revenue Board. The attack uses compressed archives containing malicious JavaScript that triggers obfuscated PowerShell scripts running entirely in memory. These scripts deploy multiple encrypted and encoded payload stages using Base64, AES, and XOR to evade detection. The final payload steals credentials from browsers, cryptocurrency wallets, messaging apps, and system information, exfiltrating data via SMTP with STARTTLS encryption. The campaign employs reflective code loading and process injection into legitimate binaries to reduce on-disk footprint and evade traditional defenses. The campaign is targeted notably at Malaysia. No known exploits in the wild or patches are indicated.

MediumMalwareMalaysia#reflective loading#smtp exfiltration#multi-stage attack