Phantom Stealer Phishing: Obfuscated Batch Dropper with Base64+XOR+Donut from Email Client

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•2

Detects instances where an email client (Outlook, Thunderbird, Edge, Chrome, Firefox) spawns `cmd.exe` with highly obfuscated command-line arguments. This behavior is characteristic of phishing delivery chains, specifically mentioning Phantom Stealer, which often uses Base64, XOR, and Donut for obfuscation. The rule looks for specific keywords and patterns indicative of obfuscated commands, such as `-enc`, `-EncodedCommand`, `FromBase64String`, `certutil`, `^^`, `!x!`, and `set /p`.