Phantom Stealer: A Stealthy .NET-Based Infostealer Leveraging PNG Steganography
Researchers from the Splunk Threat Research Team have uncovered a sophisticated credential-harvesting malware dubbed Phantom Stealer, a .NET-based infostealer designed to evade detection while exfiltrating sensitive data. The malware employs advanced techniques, including PNG steganography, PowerShell-driven process injection, and telemetry suppression, to steal passwords, browser data, cryptocurrency wallets, and local files.
Key Features & Attack Chain
Phantom Stealer’s modular architecture allows threat actors to deploy it via multiple infection vectors, including phishing emails, malicious links, cracked software, and messaging platforms like Discord and Telegram. A notable variant conceals its payload within a PNG resource embedded in a .NET assembly, decrypting the hidden executable at runtime a technique mapped to MITRE ATT&CK T1027.003 (Steganography). Similar methods have been observed in malware like Quasar RAT and LokiBot.
Once executed, the malware employs obfuscated PowerShell scripts to dynamically compile C# code, inject shellcode into explorer.exe, and bypass security controls. It also patches AMSI and ETW functions (e.g., AmsiScanBuffer, EtwEventWrite) to evade in-memory scanning and suppress telemetry, aligning with T1059.001 (PowerShell) and T1055 (Process Injection).
Data Theft & Persistence
Phantom Stealer conducts extensive environment checks to avoid detection in virtualized or sandboxed environments, analyzing hostnames, GPU details, running processes, and IP addresses. If the system is deemed safe, it launches a custom Chrome instance with sandboxing disabled to harvest:
- Browser data (Chromium/Gecko passwords, cookies, payment cards, cryptocurrency wallet extensions)
- Desktop wallets (e.g., Bitcoin, Ethereum)
- File transfer credentials (FileZilla, WinSCP)
- Outlook profiles, Wi-Fi credentials, screenshots, and keystrokes
A particularly damaging feature is clipboard hijacking: the malware monitors copied cryptocurrency addresses and replaces them with attacker-controlled wallets, redirecting transactions without requiring account access. Persistence is maintained via Registry Run keys or Startup folders, with optional post-infection plugin injections.
Detection & Indicators of Compromise (IOCs)
Splunk’s report highlights behavioral detection methods over static signatures, recommending monitoring for:
- Obfuscated PowerShell or Add-Type compilation
- Suspicious remote thread creation in explorer.exe
- Unauthorized access to browser credential stores or custom Chrome profiles
- AMSI/ETW tampering and abnormal WinSCP configuration access
Notable IOCs include:
- SHA-256 hashes:
b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32(Loader)382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961(Batch Loader)be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab(JavaScript Loader)
The malware’s accessibility and stealth underscore the growing threat of commodity infostealers, which enable even low-skilled operators to execute high-impact credential theft and financial fraud. Splunk has released 32 detection rules to aid investigations.
Source: https://gbhackers.com/phantom-stealer-uses-png-steganography/
Phantom Stealer TPRM report: https://www.rankiteo.com/company/unit42
"id": "uni1786602282",
"linkid": "unit42",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'attack_vector': ['phishing emails',
'malicious links',
'cracked software',
'messaging platforms (Discord, Telegram)'],
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['browser data',
'cryptocurrency wallets',
'payment cards',
'Wi-Fi credentials',
'Outlook profiles',
'file transfer credentials',
'screenshots',
'keystrokes']},
'description': 'Researchers from the Splunk Threat Research Team have '
'uncovered a sophisticated credential-harvesting malware '
'dubbed *Phantom Stealer*, a .NET-based infostealer designed '
'to evade detection while exfiltrating sensitive data. The '
'malware employs advanced techniques, including PNG '
'steganography, PowerShell-driven process injection, and '
'telemetry suppression, to steal passwords, browser data, '
'cryptocurrency wallets, and local files.',
'impact': {'data_compromised': ['passwords',
'browser data',
'cryptocurrency wallets',
'payment cards',
'Wi-Fi credentials',
'screenshots',
'keystrokes',
'Outlook profiles',
'file transfer credentials'],
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'lessons_learned': "The malware's accessibility and stealth underscore the "
'growing threat of commodity infostealers, which enable '
'even low-skilled operators to execute high-impact '
'credential theft and financial fraud.',
'motivation': ['credential theft', 'financial fraud'],
'post_incident_analysis': {'corrective_actions': ['Implement behavioral '
'detection methods',
'Monitor for IOCs',
"Use Splunk's detection "
'rules'],
'root_causes': ['PNG steganography',
'PowerShell-driven process '
'injection',
'telemetry suppression',
'AMSI/ETW tampering']},
'recommendations': 'Monitor for obfuscated PowerShell or Add-Type '
'compilation, suspicious remote thread creation in '
'explorer.exe, unauthorized access to browser credential '
'stores, custom Chrome profiles, AMSI/ETW tampering, and '
"abnormal WinSCP configuration access. Implement Splunk's "
'32 detection rules to aid investigations.',
'references': [{'source': 'Splunk Threat Research Team'}],
'response': {'enhanced_monitoring': ['obfuscated PowerShell or Add-Type '
'compilation',
'suspicious remote thread creation in '
'explorer.exe',
'unauthorized access to browser '
'credential stores',
'custom Chrome profiles',
'AMSI/ETW tampering',
'abnormal WinSCP configuration access']},
'title': 'Phantom Stealer: A Stealthy .NET-Based Infostealer Leveraging PNG '
'Steganography',
'type': 'Infostealer Malware'}