Listen to this Post
Introduction: A New Generation of Phishing Is More Dangerous Than Ever
Cybercriminals are no longer relying on poorly written emails or suspicious attachments to compromise organizations. Modern phishing campaigns have evolved into highly organized operations that imitate trusted brands, government agencies, and routine business communications with remarkable accuracy. By exploiting everyday workflows, attackers increase the likelihood that employees will open malicious files without hesitation.
Security researchers have recently uncovered a sophisticated campaign delivering Phantom Stealer v3.5.0, an advanced information-stealing malware that abuses legitimate Windows components, fileless execution techniques, and encrypted payloads to bypass traditional security controls. The campaign demonstrates how multiple layers of obfuscation and in-memory execution can make modern malware extremely difficult to detect while silently stealing valuable credentials and sensitive corporate information.
Campaign Overview
Security researchers at Seqrite documented a sophisticated phishing operation that impersonates both a global logistics provider and a national tax authority to distribute Phantom Stealer v3.5.0.
Although the campaign uses two completely different phishing themes, both emails eventually execute the exact same infection chain, showing that the attackers carefully designed reusable malware infrastructure while tailoring social engineering to different organizational departments.
Instead of relying on software vulnerabilities, the campaign focuses on manipulating human trust, making employee awareness one of the most critical security controls.
UPS Shipment Booking Lure Targets Procurement Teams
One variation of the phishing campaign impersonates UPS Forwarding Hub.
Victims receive what appears to be a legitimate shipment booking confirmation containing quotation details, shipment references, and logistics information commonly exchanged between suppliers and procurement departments.
The attachment appears authentic by using filenames such as:
UPS Docs_Shipment Number 3264010420-Quote ID 203263067.js
Because logistics personnel frequently exchange shipping documents, the malicious attachment blends naturally into everyday business operations.
Fake Malaysian Tax Audit Pressures Finance Departments
The second phishing scenario is specifically crafted for financial personnel.
Attackers impersonate
The message claims the recipient is under tax audit and demands supporting documentation within fourteen days.
By creating urgency and referencing legal obligations, attackers pressure recipients into opening the attached archive before verifying its legitimacy.
This demonstrates how attackers customize phishing emails according to regional language, government branding, and department responsibilities.
The Archive Conceals a Dangerous JavaScript Loader
Instead of sending executable malware directly, attackers deliver a compressed archive containing an obfuscated JavaScript file.
At first glance, the file appears to be ordinary documentation related to shipping or taxation.
However, executing the script silently launches the malware infection chain without displaying obvious signs of compromise.
This initial stage serves as the gateway to the remaining malware deployment process.
Stage One: Obfuscated JavaScript Begins the Attack
The JavaScript loader is heavily obfuscated using numeric string-array indexing, making reverse engineering significantly more difficult.
Rather than downloading malware from external servers, the script already contains a massive Base64-encoded PowerShell payload embedded directly inside its code.
Using native Windows COM objects, the script decodes the payload and executes PowerShell in hidden mode.
Since no additional download occurs, network-based security solutions have fewer opportunities to detect suspicious activity.
Stage Two: AES-Encrypted PowerShell Loader
After execution, the second stage activates another PowerShell loader.
Instead of storing readable commands, this stage encrypts its payload using:
AES Encryption
CBC Mode
PKCS7 Padding
Both the encryption key and initialization vector are stored as Base64 strings inside the script.
Using the .NET AesCryptoServiceProvider, the malware decrypts everything directly in memory before executing it through Invoke-Expression, avoiding unnecessary disk activity.
Stage Three: Reflective .NET Injection
The third loader significantly raises the sophistication level.
It contains two different payloads.
The first is an XOR-encrypted .NET injector protected using the key:
DEVILboy56@@
The second payload is stored as a raw decimal byte array.
Once decoded, researchers confirmed it forms a legitimate Portable Executable (PE) file identified by its familiar MZ header.
Instead of writing the executable onto disk, the malware reflectively injects it into the legitimate Windows process:
aspnet_compiler.exe
Running inside a trusted Microsoft process greatly reduces the chance of detection by conventional endpoint protection platforms.
Stage Four: Phantom Stealer v3.5.0 Executes
The final payload is Phantom Stealer version 3.5.0.
Once active, the malware begins harvesting valuable information from the infected system, including:
Browser passwords
Browser cookies
Saved payment cards
Cryptocurrency wallet information
Messaging application files
User profiles
Stored credentials
Collected information is organized into categorized files such as:
Chromium_passwords_.txt
This structured organization allows attackers to rapidly identify high-value data after receiving stolen information.
SMTP Exfiltration Helps the Malware Blend Into Normal Traffic
One of the
Instead of using HTTP or custom command-and-control channels, Phantom Stealer authenticates directly with an SMTP server over port 587.
The malware performs:
AUTH LOGIN authentication
STARTTLS encryption
Individual file transfers
QUIT session termination
Because SMTP traffic is common within corporate environments, this communication appears similar to legitimate outbound email, making detection considerably more difficult.
Researchers observed Base64-encoded SMTP credentials associated with the campaign, highlighting how attackers leverage existing email infrastructure instead of maintaining dedicated command servers.
No Single Threat Actor Has Been Identified
Researchers have not conclusively linked this campaign to any known threat group.
This is unsurprising because Phantom Stealer is widely available within underground cybercrime marketplaces.
Commodity malware allows multiple criminal groups to deploy nearly identical campaigns while modifying only phishing themes or infrastructure.
As a result, attribution becomes significantly more challenging.
Why This Campaign Is Particularly Dangerous
Several technical decisions make this campaign far more sophisticated than ordinary phishing attacks.
The malware performs nearly every critical operation in memory.
It avoids writing executable files to disk.
It encrypts payloads before execution.
It abuses trusted Windows components.
It injects malicious code into legitimate Microsoft processes.
Finally, it exfiltrates information through encrypted SMTP sessions that closely resemble normal business email traffic.
Combined, these techniques dramatically reduce the visibility available to traditional antivirus products.
Recommended Defensive Measures
Organizations should adopt layered security controls rather than relying solely on antivirus software.
Recommended defenses include:
Block JavaScript execution from email attachments.
Disable unnecessary Windows Script Host execution.
Restrict PowerShell where operationally possible.
Monitor reflective code loading.
Detect suspicious PowerShell child processes.
Alert on unusual outbound SMTP authentication.
Enable Endpoint Detection and Response (EDR).
Implement application allow-listing.
Train employees to recognize shipment and tax-themed phishing attacks.
Monitor process injection into trusted Windows executables.
Deep Analysis
Modern malware increasingly avoids traditional executable delivery in favor of living-off-the-land techniques that abuse legitimate Windows functionality. Phantom Stealer is an excellent example of this trend. Every stage is designed to reduce forensic artifacts while maximizing persistence during execution. Rather than downloading obvious binaries, the malware embeds payloads, decrypts them entirely in memory, and executes them without leaving easily recoverable files on disk.
Reflective process injection into aspnet_compiler.exe is particularly noteworthy because it leverages a trusted Microsoft executable to hide malicious behavior. Security teams relying only on process reputation may completely overlook this activity. Behavioral detection therefore becomes far more important than signature-based scanning.
Monitoring PowerShell activity is another critical defense. Hidden PowerShell windows, Base64-encoded commands, unusual COM object creation, and in-memory .NET execution are all indicators that should trigger immediate investigation. Organizations should also inspect outbound SMTP traffic for anomalous authentication events, especially when workstations—not mail servers—initiate encrypted SMTP sessions over port 587.
Example PowerShell Logging Commands
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
Get-ExecutionPolicy -List
Set-ExecutionPolicy RemoteSigned
Get-Process powershell
Get-Process aspnet_compiler
Enable PowerShell Script Block Logging
Set-ItemProperty <code>-Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging</code> -Name EnableScriptBlockLogging <code>-Type DWord</code> -Value 1
Monitor SMTP Connections
netstat -ano | findstr :587
Search Windows Event Logs
Get-WinEvent -LogName Security
Detect Suspicious PowerShell Encoding
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational |
Where-Object {$_.Message -match "EncodedCommand"}
Modern Security Operations Centers should combine behavioral analytics, endpoint telemetry, PowerShell logging, memory analysis, and network monitoring into a unified detection strategy. Individually, each stage of Phantom Stealer may appear benign, but together they form a highly sophisticated attack chain capable of bypassing traditional defenses.
What Undercode Say:
This campaign highlights how phishing has evolved from simple email scams into carefully engineered intrusion chains. The attackers no longer depend on exploiting software vulnerabilities—they exploit trust. By impersonating a logistics company and a government tax authority, they increase the probability that recipients will interact with the attachment without questioning its legitimacy.
The malware’s architecture reflects a mature understanding of modern defensive technologies. Every layer is designed to evade detection through encryption, obfuscation, reflective loading, and in-memory execution. These techniques reduce forensic evidence while extending the malware’s operational lifespan inside compromised environments.
One of the most concerning aspects is the elimination of external payload downloads during the early stages. Security products that rely on monitoring suspicious downloads may never observe the malware entering the system because the payload is already embedded within the JavaScript file.
The use of AES encryption and staged PowerShell loaders demonstrates professional malware development rather than opportunistic scripting. Each layer acts as a defensive barrier against analysts and automated security tools, requiring investigators to peel back multiple levels before reaching the final payload.
Reflective process injection into aspnet_compiler.exe shows that attackers continue to abuse trusted Windows binaries to camouflage malicious activity. Security teams should move beyond process names and instead analyze behavioral patterns, memory anomalies, and command-line activity.
Equally notable is the
The campaign also demonstrates the flexibility of commodity malware. Phantom Stealer is not exclusive to one threat actor, meaning countless criminal groups can purchase, customize, and deploy similar operations with minimal effort. This democratization of cybercrime lowers the barrier to entry for attackers while increasing the volume of sophisticated campaigns targeting businesses worldwide.
Organizations should treat procurement departments, finance teams, and executive assistants as high-value targets because they regularly receive invoices, shipment notifications, and regulatory communications. Specialized awareness training tailored to departmental workflows can significantly reduce phishing success rates.
Endpoint Detection and Response solutions remain one of the strongest defenses against this class of attack, but technology alone is insufficient. Effective security requires visibility into PowerShell activity, process injection events, memory execution, SMTP anomalies, and user behavior.
As malware continues to adopt fileless execution techniques, defenders must shift from static detection toward behavioral analytics, threat hunting, and continuous monitoring. Campaigns like this illustrate that the future of cybersecurity will increasingly depend on identifying suspicious behavior rather than identifying malicious files.
✅ Confirmed: Seqrite documented a multi-stage phishing campaign delivering Phantom Stealer v3.5.0 through fake UPS and Malaysian tax authority emails. The infection chain, staged loaders, and malware capabilities are consistent with the reported technical analysis.
✅ Confirmed: The malware employs multiple defense-evasion techniques, including JavaScript obfuscation, in-memory PowerShell execution, AES-encrypted payloads, reflective process injection, and SMTP-based data exfiltration over STARTTLS. These methods align with current malware tradecraft observed in real-world attacks.
✅ Confirmed with Context: No specific threat actor has been publicly attributed to this campaign. Phantom Stealer is considered commodity malware that can be acquired and deployed by multiple cybercriminal operators, making attribution difficult without additional infrastructure or operational evidence.
Prediction
(+1) Security vendors will continue improving behavioral detection for reflective process injection, encoded PowerShell execution, and abnormal SMTP traffic, making future variants of Phantom Stealer easier to identify despite their fileless techniques.
(-1) Cybercriminals are likely to expand this campaign by impersonating additional logistics providers, financial institutions, and government agencies while introducing AI-generated phishing emails that further increase credibility and success rates against enterprise targets.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
