Executive Summary
A multi-stage campaign leading to the deployment of Phantom Stealer has been identified, characterized by the use of highly obfuscated VBScript droppers and .NET loaders. The attack typically begins with social engineering via a decoy invoice, which triggers a VBScript to download a ZIP file containing a malicious executable. This executable, often obfuscated using ConfuserX, establishes persistence and prepares the environment for data theft.
Technical analysis reveals that the malware utilizes advanced evasion tactics including control-flow flattening, in-memory execution of encrypted assemblies, and remote process injection using common Windows APIs. Exfiltration and Command-and-Control (C2) operations are conducted over HTTPS, frequently abusing the legitimate Telegram API (api.telegram.org) to blend malicious traffic with normal encrypted web activity.
The business impact is significant, as the malware targets sensitive user data including browser credentials, session tokens, and Wi-Fi profiles. The use of legitimate services for C2 and robust obfuscation techniques makes detection by traditional antivirus and network monitoring solutions challenging, necessitating behavioral-based detection strategies.