Phantom Stealer Malware Uses Steganography, PowerShell Shellcode to Steal Credentials

A new infostealer dubbed Phantom Stealer is quietly reshaping the credential-theft landscape, combining image-based steganography, PowerShell-driven shellcode injection, and AMSI/ETW tampering to slip past endpoint defenses while draining browsers, crypto wallets, and clipboards of sensitive data.

According to research published by the Splunk Threat Research Team on July 28, 2026, Phantom Stealer is a .NET-based credential harvester distributed through phishing emails, cracked software, and malicious links shared on Discord and Telegram.

Its low technical barrier to entry has made it popular with both novice and advanced threat actors, fueling rapid adoption across multiple countries since its emergence.

Phantom Stealer Malware Uses Steganography

One loader variant embeds the malicious payload inside a .NET resource manifest disguised as a PNG image, a technique previously seen in Quasar RAT and Lokibot campaigns. Splunk researchers extracted an encrypted blob from the image entry that, once decrypted, revealed the final Phantom Stealer payload.

A second infection path uses obfuscated PowerShell that dynamically compiles C# via Add-Type, wiring up randomized P/Invoke calls to Windows APIs. It follows the textbook process-injection chain: OpenProcess, VirtualAllocEx, WriteProcessMemory, VirtualProtectEx, and CreateRemoteThread to inject shellcode into explorer.exe.

That shellcode then patches AmsiScanBuffer, AmsiScanString, and EtwEventWrite, effectively blinding AMSI and ETW telemetry before unpacking the stealer itself.

Before harvesting anything, Phantom Stealer profiles its environment. It checks usernames, hostnames, GPU strings, running processes, service names, and machine GUIDs against known sandbox and VM artifacts, and even runs a 10-millisecond timing check to catch emulators that skip sleep calls. It also launches Chrome with --no-sandbox and --user-data-dir flags to operate covertly within an isolated browser instance.

“What stands out about Phantom Stealer isn’t any single technique; steganographic loaders and AMSI patching aren’t new it’s the sheer density of anti-analysis checks packed into one modular kit.

That combination lowers the skill floor for attackers while raising the detection bar for defenders, which is exactly why commodity stealers like this are outpacing more sophisticated but narrower malware families in real-world prevalence.”

Once active, Phantom Stealer casts a wide net: Chromium and Gecko browser passwords, cookies, and saved credit cards; browser-extension wallet data; desktop wallets including MetaMask, Exodus, Electrum, and Binance; WinSCP and FileZilla credentials; Outlook profile data; Wi-Fi profiles and BSSID information via netsh; and registry-stored cryptocurrency wallet identifiers.

It also runs a keylogger, captures screenshots, and monitors the clipboard, swapping copied crypto wallet addresses with attacker-controlled ones that are encrypted with AES-CBC. Persistence is achieved through Registry Run keys or Startup folder drops, and the malware can pull additional plugins from its C2 server for follow-on process injection.

Splunk’s team released five detections targeting this kill chain: Chromium browsers launched with custom user-data directories; PowerShell Script Block Logging patterns matching P/Invoke injection API chains; non-Chrome processes touching Chrome’s Local State file; remote thread creation in trusted processes like explorer.exe or notepad.exe; and unauthorized access to WinSCP’s credential store.

Security teams monitoring PowerShell logging, Sysmon Event ID 8, and Windows Security Event 4663 stand the best chance of catching Phantom Stealer before credentials leave the network.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.