Phantom Stealer Malware Exploits Fake UPS & Tax Emails in Multi-Stage Attack

Threat actors are weaponizing the routine paperwork of global business shipment quotes and tax audit letters to smuggle a sophisticated information stealer past enterprise defenses using layered, fileless execution techniques.

Security researchers at Seqrite recently uncovered a phishing operation that abandons flashy lures in favor of documents employees expect to see in their inbox every week.

One email impersonates UPS Forwarding Hub, complete with a shipment number, quotation ID, and consignee charges designed to catch the eye of procurement and logistics staff.

Phantom Stealer Malware Exploits

A second, written entirely in Malay, poses as an official notice from Malaysia’s Inland Revenue Board (LHDN), demanding tax audit documentation within a 14-day deadline to pressure finance teams into acting fast.

Despite targeting different departments with different anxieties, both emails funnel victims into the exact same infection chain a telling sign that the attackers are running a single malware distribution pipeline behind multiple social-engineering facades.

As one incident responder tracking business-email compromise trends put it, “Attackers no longer need to invent urgency; they just borrow it from the calendar events every finance and logistics team already dreads.”

Each phishing email carries a compressed archive containing a JavaScript file with a filename tailored to the lure, such as “UPS Docs_Shipment Number 3264010420-Quote ID 203263067.js”. Once opened, the script isn’t the payload itself; it’s a heavily obfuscated loader.

Function names and command strings are replaced with numeric indices pointing to hidden string arrays, a technique that forces analysts to manually unwind layers of meaningless arithmetic wrappers before finding real logic.

Buried inside the JavaScript is a large Base64-encoded blob, an entire PowerShell script embedded directly in the source rather than fetched from an external server. This self-contained design means the malware doesn’t need to “phone home” for its next stage, making network-based detection harder during the earliest phase of infection.

The recovered PowerShell script doesn’t reveal its logic in plaintext either. It stores the next stage as AES-encrypted data, with the ciphertext, key, and initialization vector all Base64-encoded inside the script.

Using .NET’s native AesCryptoServiceProvider class in CBC mode with PKCS7 padding, the loader decrypts everything directly into memory and passes the result to Invoke-Expression, ensuring no additional file ever touches disk.

A second PowerShell layer then unpacks two distinct payloads: a small XOR-encrypted .NET “injector” assembly (protected with the hardcoded key “DEVILboy56@@”) and a raw PE file stored as a decimal byte array, whose “MZ” DOS header confirms it as a genuine executable rather than shellcode.

The injector loads this PE reflectively into the legitimate aspnet_compiler.exe process, a classic process-injection trick that lets malicious code run under the guise of a trusted Windows component.seqrite+1

The final payload, Phantom Stealer v3.5.0, is a widely circulated commodity stealer available across cybercriminal marketplaces rather than a bespoke tool tied to one group.

Once active, it systematically scrapes the host for credentials, cookies, saved payment cards, cryptocurrency wallet files, and messaging-app data, sorting everything into categorized files like Chromium_passwords_<hostname>.txt for efficient theft.

Exfiltration happens over SMTP on port 587, the standard authenticated email submission port, using EHLO and STARTTLS to wrap the stolen data in TLS encryption, making the traffic resemble ordinary corporate email rather than an obvious data leak.

Seqrite observed the malware authenticating with real, Base64-encoded credentials before transmitting stolen files and cleanly closing the session with a QUIT command.

Seqrite’s analysts found no conclusive link to a specific threat actor, noting Phantom Stealer’s broad availability in the cybercrime underground means multiple operators likely run near-identical campaigns.

That anonymity doesn’t lessen the risk: the campaign’s real innovation isn’t the stealer itself but the discipline of its delivery chain, where each stage exposes only enough to launch the next, frustrating static analysis at every step.

For defenders, the recommended countermeasures are unglamorous but effective: restrict unnecessary script execution, monitor for unusual PowerShell activity and reflective memory loading, and flag outbound SMTP traffic that doesn’t match normal mail server patterns.

As business-themed phishing grows harder to distinguish from genuine correspondence, layered detection across email, endpoint, and network telemetry remains the most reliable safety net.

About the Author

Potheeswaran

Author

Visit Website View All Posts