Phantom Stealer Campaign Uses JavaScript and PowerShell to Steal Browser Credentials

Severity
Medium

Detail

Security researchers at Seqrite have identified a sophisticated phishing campaign that disguises malware delivery within routine business communications to deploy Phantom Stealer v3.5.0. The campaign uses two phishing themes that ultimately lead to the same multi-stage infection chain.

One phishing email impersonates UPS Forwarding Hub, referencing fake shipment bookings and quotation IDs to target procurement teams. The second impersonates Malaysia’s Inland Revenue Board (LHDN), using a Malay-language tax notice that requests tax documentation within 14 days to pressure finance personnel.

Both phishing emails deliver a compressed archive containing a malicious JavaScript file with business-related filenames, such as “UPS Docs_Shipment Number 3264010420.js,” to blend into normal business workflows and reduce suspicion.

How?

The attack consists of four stages:

Stage 1 – JavaScript Loader

• The victim executes the malicious JavaScript file contained within the compressed archive.
• The script uses string-array obfuscation and indirect function calls to conceal its functionality.
• It decodes an embedded Base64-encoded PowerShell script, writes it as a temporary .ps1 file, and executes it using hidden powershell.exe parameters.

Stage 2 – PowerShell Decryption

• The PowerShell script decrypts an AES-encrypted payload using an embedded Base64-encoded key and initialization vector (IV).
• The decrypted payload is executed directly in memory using Invoke-Expression, avoiding disk writes.

Stage 3 – Payload Injection

• A second PowerShell loader extracts two payloads:
  • An XOR-encrypted .NET injector assembly using the key “DEVILboy56@@”.
  • A Phantom Stealer executable stored as a raw byte-array PE file.
• The injector reflectively loads and injects Phantom Stealer into the legitimate aspnet_compiler.exe process.

Stage 4 – Phantom Stealer Execution

• Phantom Stealer v3.5.0 executes entirely in memory.
• The malware collects sensitive information and prepares it for exfiltration.

For data exfiltration, Phantom Stealer connects to an SMTP server over port 587, authenticates using Base64-encoded AUTH LOGIN credentials, upgrades the connection using STARTTLS, transmits the stolen information, and closes the session using a standard QUIT command.

Impact

Phantom Stealer collects and organizes stolen information into files named using the victim’s hostname, including:

• Chromium_passwords
• Chromium_credit_cards
• Chromium_cookies
• Gecko_passwords
• Gecko_cookies

The malware also targets:

• Browser credentials
• Browser cookies
• Payment card information
• Cryptocurrency wallet data
• Messaging application data stored on the compromised system

Seqrite stated that no conclusive attribution has been made to a specific threat actor and that Phantom Stealer appears to be commodity malware used by multiple cybercriminal operators.

Recommendation

Seqrite recommends that organizations:

• Treat unexpected shipment, banking, or tax-related attachments with caution.
• Restrict unnecessary script execution where possible.
• Monitor for anomalous PowerShell activity.
• Detect reflective memory loading and process injection.
• Monitor for unusual SMTP traffic.
• Implement a defense-in-depth strategy combining email security, endpoint monitoring, and network visibility to detect multi-stage fileless attacks before sensitive data is compromised.

Conclusion

The Phantom Stealer campaign demonstrates the use of multi-stage JavaScript and PowerShell loaders to execute malware entirely in memory while minimizing its on-disk footprint. By disguising malicious attachments as routine business documents and using encrypted, fileless execution techniques, the campaign is designed to steal browser credentials, financial information, cryptocurrency wallet data, and other sensitive information while evading traditional detection methods.

Indicator of Compromise (IOCs)

Type	Value
Hash	6BBFC88534D5D515DDDB0EC9BB618530
Hash	8A620E451E64F418BC21FD458E952F2E
Hash	5F238710A5EF4F6DDBBE7A118C822705
Hash	a30b628d0c087f305b35be3e3f5281b3
Hash	34bfa888695b9aaa41bd575245972043
Seqrite Detection	Trojan.Injector.S39585891
Seqrite Detection	Trojan.YakbeexMSIL.ZZ4
Seqrite Detection	PS.Trojan.Loader.50921.GC
Seqrite Detection	Js.Trojan.Loader.50922.GC

Source

https://gbhackers.com/phantom-stealer-campaign-javascript-powershell/
https://www.seqrite.com/blog/abusing-trusted-business-workflows-a-multi-stage-phantom-stealer-campaign/