Phantom Stealer Malware Hides Payload in PNG Images

Executive Summary

Phantom Stealer, a modular .NET-based information stealer, is being actively distributed in campaigns utilizing multiple evasion and data theft techniques. A key feature of this malware is its use of steganography, where it hides its encrypted payload within a file resource disguised as a PNG image. This allows it to bypass some static detection methods. The malware is being spread through common vectors like phishing emails and malicious links on platforms like Discord and Telegram. Once executed on a Windows system, Phantom Stealer harvests a wide array of sensitive information, with a strong focus on credentials, cookies, and cryptocurrency wallets. Its combination of stealthy delivery and comprehensive data collection makes it a potent threat to both individuals and organizations.

Threat Overview

Phantom Stealer is a credential and information theft tool designed for widespread impact. Its distribution methods are varied, targeting users through social engineering on popular platforms.

Infection Vectors:

• Phishing emails with malicious attachments or links.
• Malicious links shared on Discord and Telegram servers.
• Trojanized software installers masquerading as legitimate applications.

Evasion Techniques:

• Steganography: In some variants, a loader contains an encrypted payload hidden within a resource file that mimics a PNG image. This payload is decrypted and loaded directly into memory. This is a form of T1027 - Obfuscated Files or Information.
• PowerShell Injection: Other campaigns use heavily obfuscated PowerShell scripts to perform process injection (T1059.001 - PowerShell), running the stealer's code within the context of a legitimate process like explorer.exe.
• Persistence: The malware ensures it runs on system startup by creating entries in the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key or by dropping a shortcut in the user's Startup folder (T1547.001 - Registry Run Keys / Startup Folder).

Technical Analysis

Upon execution, Phantom Stealer begins its data harvesting routine. Its primary targets include:

• Web Browsers: Steals saved credentials, session cookies, and credit card information from popular browsers like Chrome, Firefox, and Edge.
• Cryptocurrency: It actively searches for data related to cryptocurrency. This includes:
  • Browser-based wallet extensions (e.g., MetaMask, Phantom).
  • Desktop wallet application files.
  • A clipboard-hijacking module (T1115 - Clipboard Data) that monitors the clipboard for cryptocurrency wallet addresses and replaces them with an attacker-controlled address.
• Other Applications: It exfiltrates saved credentials from FTP clients such as FileZilla and WinSCP, as well as Outlook profile data.
• System Information: The stealer also captures saved Wi-Fi profiles, takes screenshots of the desktop (T1113 - Screen Capture), and can log keystrokes (T1056.001 - Keylogging).

All collected data is typically compressed and exfiltrated to a command-and-control (C2) server over HTTP or another common protocol.

Impact Assessment

A successful infection by Phantom Stealer can lead to a complete compromise of a user's digital identity. The theft of browser cookies can allow attackers to bypass MFA and hijack active sessions for corporate and personal accounts. The theft of cryptocurrency wallets can result in immediate and irreversible financial loss. For organizations, a compromised employee endpoint can serve as a beachhead for a larger network intrusion, as stolen credentials can be used for lateral movement.

IOCs — Directly from Articles

No specific file hashes, C2 domains, or IP addresses were disclosed in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for activity related to Phantom Stealer using the following clues:

Detection & Response

• Endpoint Security: A modern EDR solution with behavioral detection capabilities is crucial for identifying techniques like process injection and in-memory execution. D3FEND's Process Analysis (D3-PA) is essential.
• PowerShell Logging: Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging. This will record the content of obfuscated scripts once they are de-obfuscated for execution, allowing for analysis and detection.
• File Analysis: Use security tools capable of deep file inspection to identify steganographic content or embedded payloads within seemingly benign files. This corresponds to File Analysis (D3-FA).
• Network Monitoring: Monitor egress traffic for connections to suspicious domains or patterns indicative of data exfiltration.

Mitigation

• Email & Web Security: Employ robust email and web filtering solutions to block phishing attempts, malicious attachments, and links to known malicious sites. This aligns with M1021 - Restrict Web-Based Content.
• Application Control: Use application allowlisting to prevent the execution of unauthorized software downloaded from the internet. This is a form of M1038 - Execution Prevention.
• User Training: Educate users on the dangers of downloading software from untrusted sources and clicking suspicious links, especially on platforms like Discord and Telegram.
• Credential Protection: Encourage the use of password managers to avoid browser-based password storage, which is a primary target for stealers. Use phishing-resistant MFA wherever possible to mitigate the impact of stolen credentials.