Phantom Stealer phishing delivery and exfiltration activity
Malware Activity
Summary
Hide ▲
Show ▼
Phantom Stealer is being delivered through a phishing campaign that uses a ZIP-to-ISO attachment chain to bypass mail defenses, exposing Russian-speaking organizations to credential theft and token theft. The lure is a fake bank transfer confirmation written in formal Russian business language. Once opened, the attachment chain mounts an ISO and launches a disguised executable that deploys the stealer in memory. The activity matters because it combines ISO-based initial access with broad browser, wallet, and token harvesting plus multi-channel exfiltration.
Related Happenings
SideCopy Operation XENOFISCAL spear-phishing campaign targeting Afghan finance entities
Campaign
H score25
First: 02.06.2026 12:05
Last: 02.06.2026 12:05
Sources 1
About this happening:
The SideCopy-linked Operation XENOFISCAL spear-phishing campaign is targeting Afghanistan's Ministry of Finance and related provincial finance offices with Xeno RAT*...
SideCopy Operation XENOFISCAL spear-phishing campaign targeting Afghan finance entities
CampaignAbout this happening: The SideCopy-linked Operation XENOFISCAL spear-phishing campaign is targeting Afghanistan's Ministry of Finance and related provincial finance offices with Xeno RAT*...
Silent subject/null subject phishing campaign targeting executives and privileged users
Campaign
H score32
First: 22.04.2026 16:00
Last: 22.04.2026 16:00
Sources 1
About this happening:
A widespread silent subject/null subject phishing campaign is sending subject-less emails to high-value users, raising the risk of credential theft and follow-on lat...
Silent subject/null subject phishing campaign targeting executives and privileged users
CampaignAbout this happening: A widespread silent subject/null subject phishing campaign is sending subject-less emails to high-value users, raising the risk of credential theft and follow-on lat...
Phantom Stealer Europe phishing campaign
Campaign
H score33
First: 31.03.2026 17:00
Last: 31.03.2026 17:00
Sources 1
About this happening:
A sustained phishing campaign delivered Phantom Stealer to organizations in logistics, manufacturing and technology across Europe, creating a broad credential-thef...
Phantom Stealer Europe phishing campaign
CampaignAbout this happening: A sustained phishing campaign delivered Phantom Stealer to organizations in logistics, manufacturing and technology across Europe, creating a broad credential-thef...
Operation MoneyMount-ISO Phantom Stealer phishing campaign targeting Russian finance entities
Campaign
H score33
First: 15.12.2025 11:24
Last: 15.12.2025 11:24
Sources 1
About this happening:
The Operation MoneyMount-ISO phishing campaign is actively targeting organizations in Russia, and it matters because the emails deliver Phantom Stealer through malic...
Operation MoneyMount-ISO Phantom Stealer phishing campaign targeting Russian finance entities
CampaignAbout this happening: The Operation MoneyMount-ISO phishing campaign is actively targeting organizations in Russia, and it matters because the emails deliver Phantom Stealer through malic...
Winos 4.0 and HoldingHands RAT malware activity expanding targeting to Japan and Malaysia
Malware Activity
H score23
First: 18.10.2025 09:51
Last: 18.10.2025 09:51
Sources 1
About this happening:
The Winos 4.0 malware operation has expanded its target footprint to Japan and Malaysia through HoldingHands RAT, increasing the reach of a multi-stage phishing de...
Winos 4.0 and HoldingHands RAT malware activity expanding targeting to Japan and Malaysia
Malware ActivityAbout this happening: The Winos 4.0 malware operation has expanded its target footprint to Japan and Malaysia through HoldingHands RAT, increasing the reach of a multi-stage phishing de...
Timeline
-
15.12.2025 18:00 2 articles · 7mo ago
Operation MoneyMount-ISO delivers Phantom Stealer
Initial DisclosureSeqrite Labs identified Operation MoneyMount-ISO, a Russia-origin phishing campaign that used a fake payment confirmation email and a ZIP-to-ISO attachment chain to deploy Phantom Stealer into Russian-speaking organizations, with a clear focus on finance, accounting, treasury and payments teams. The staged payload chain mounted an ISO, launched a disguised executable, decrypted a malicious DLL, injected the stealer in memory, and used anti-analysis checks to evade sandboxes and virtual machines before exfiltrating browser passwords, cookies, credit-card data, cryptocurrency wallets, keystrokes, clipboard contents, and Discord authentication tokens through Telegram bots, Discord webhooks and FTP servers.
Show sources
- Russian Phishing Campaign Delivers Phantom Stealer Via ISO Files — www.infosecurity-magazine.com — 15.12.2025 18:00
- Russian Phishing Campaign Delivers Phantom Stealer Via ISO Files — www.infosecurity-magazine.com — 15.12.2025 18:00