Full Report
Contents · Introduction · Campaign Overview · Initial Access · Infection Chain · Technical Analysis – Stage 1: Initial Delivery (Archive→JavaScript) – Stage 2: PowerShell Loader1 Analysis – Stage 3: PowerShell Loader2 Analysis – Stage 4 – Phantom Stealer v3.5.0: Data Harvesting and Exfiltration · Campaign Attribution · Conclusion · IOC’s · Seqrite Detection Coverage- · MITRE Attack […] The post Abusing Trusted Business Workflows: A Multi-Stage Phantom Stealer Campaign appeared first on Seqrite Labs.
Analysis Summary
# Tool/Technique: Phantom Stealer v3.5.0
## Overview
Phantom Stealer is a sophisticated info-stealer malware designed to harvest sensitive credentials, system information, and browser data. This specific campaign utilizes a multi-stage, fileless infection chain initiated through business-themed phishing lures (UPS and Malaysian Tax Authority). The malware leverages obfuscated JavaScript and PowerShell loaders to eventually inject the final .NET payload into legitimate system processes.
## Technical Details
- **Type:** Malware Family (Infostealer)
- **Platform:** Windows
- **Capabilities:** Information harvesting, credential theft, fileless execution, and SMTP exfiltration.
- **First Seen:** Campaign reported July 22, 2026 (Analysis references dates in June 2026).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
- **TA0002 - Execution**
- T1059.007 - Command and Scripting Interpreter: JavaScript
- T1059.001 - Command and Scripting Interpreter: PowerShell
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1140 - De-obfuscate/Decode Files or Information
- T1620 - Reflective Code Loading
- T1036 - Masquerading
- T1055 - Process Injection
- T1218 - System Binary Proxy Execution
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- T1057 - Process Discovery
- **TA0006 - Credential Access**
- T1555.003 - Credentials from Web Browsers
- **TA0009 - Collection**
- T1005 - Data from Local System
- T1560 - Archive Collected Data
- **TA0011 - Command and Control**
- T1071.003 - Application Layer Protocol: Mail Protocols (SMTP)
- T1573 - Encrypted Channel (STARTTLS)
- **TA0010 - Exfiltration**
- T1048 - Exfiltration Over Alternative Protocol
## Functionality
### Core Capabilities
- **Information Harvesting:** Extracts stored credentials and cookies from various web browsers.
- **System Discovery:** Collects host information including system specifications and process lists.
- **Data Organization:** Automatically archives collected data into structured files for exfiltration.
- **Exfiltration via SMTP:** Uses the Simple Mail Transfer Protocol (SMTP) with STARTTLS encryption to send stolen data to the attacker’s mailbox.
### Advanced Features
- **Fileless Execution:** Utilizes multi-stage PowerShell loaders that execute the final payload directly in memory using reflective code loading.
- **Process Injection:** Injects the malicious payload into the legitimate `aspnet_compiler.exe` process to bypass security monitoring.
- **Layered Obfuscation:** Employs multiple layers of encoding (Base64, AES, and XOR) across JavaScript and PowerShell stages to hinder static analysis.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `9603D6D906E1A7D0D9D83E96D3D61DF83537233B938D82A2E9F6E36EBC65691F`
- `EC6D0732E95BE89255E2D071375B8B9B1E63CBEAB5D2C2A16972CD787A7D754B`
- `91026049EA03859D3D0976191FA7147A837583D939F80D8782E7A07F0385750A`
- **File Names:** Typically disguised as business documents within ZIP archives (e.g., shipment details or tax audit documents).
- **Network Indicators:**
- C2/Exfiltration: Exfiltrates data via SMTP (Port 587 or 465) using encrypted channels.
- **Behavioral Indicators:**
- `wscript.exe` launching `powershell.exe` with highly obfuscated or Base64 encoded arguments.
- Unexpected network connections from `aspnet_compiler.exe` to external mail servers.
## Associated Threat Actors
- **Attribution:** Specific group not named, but noted for targeting procurement and finance departments in corporate environments using localized lures (e.g., Malaysian business context).
## Detection Methods
- **Signature-based:** Detection of known malicious scripts (Seqrite: `Js.Trojan.Loader.50922.GC`, `PS.Trojan.Loader.50921.GC`).
- **Behavioral:** Monitoring for "Living off the Land" (LotL) techniques, such as PowerShell reflective loading and process hollowing of `.NET` binaries.
- **Memory Analysis:** Scanning for decrypted .NET assemblies in the memory space of `aspnet_compiler.exe`.
## Mitigation Strategies
- **Email Security:** Implement advanced threat protection to scan for malicious JavaScript within archives.
- **Scripting Restrictions:** Disable `wscript.exe` for end-users and enforce PowerShell Constrained Language Mode via AppLocker.
- **Endpoint Hardening:** Enable Attack Surface Reduction (ASR) rules to block process injections and suspicious script executions.
- **Network Monitoring:** Block or monitor outbound SMTP traffic from non-mail server internal hosts.
## Related Tools/Techniques
- **Living off the Land (LotL):** Abuse of `aspnet_compiler.exe` and `PowerShell.exe`.
- **Reflective Loading:** Similar to techniques used by Cobalt Strike or other advanced stagers to avoid writing PE files to disk.