Phantom Stealer Screen Capture via GDI BitBlt or PrintWindow from explorer.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

This rule detects suspicious activities indicative of Phantom Stealer malware injecting into 'explorer.exe'. It looks for screen capture API calls originating from 'explorer.exe', the loading of GDI DLLs into 'explorer.exe', and 'explorer.exe' being spawned from unexpected parent processes, all of which are behaviors associated with Phantom Stealer.