Phantom Stealer JS Powershell Execution

Tim Peck@timpeck

•updated Nov 20, 2025•2•0•104

Detects a PowerShell process launched by a JavaScript script host (wscript.exe or cscript.exe) that contains command-line arguments indicative of downloading, decoding, and reflectively loading a payload, a technique used by Phantom Stealer.