New Phantom Stealer Campaign Hits Windows Machines Through ISO Mounting

Researchers have uncovered a sophisticated phishing campaign originating in Russia that deploys the Phantom information-stealing malware via malicious ISO files.

The attack, dubbed “Operation MoneyMount-ISO,” targets finance and accounting departments explicitly using fake payment confirmation emails to trick victims into executing the payload.

The campaign primarily focuses on finance, accounting, treasury, and payment departments in Russia, with secondary targets including procurement, legal, HR/payroll teams, executive assistants, and Russian-speaking small and medium enterprises.

The attack poses significant risks, including credential theft, invoice and payment fraud, unauthorized fund transfers, and lateral movement into IT systems.

The infection begins with a Russian-language phishing email titled “Подтверждение банковского перевода” (Confirmation of Bank Transfer) sent from compromised domains.

The message impersonates TorFX Currency Broker and contains a ZIP attachment approximately 1 MB in size. When victims open the ZIP file, they find a malicious ISO file disguised as a legitimate bank transfer confirmation document.

Upon execution, the ISO file auto-mounts as a virtual CD drive, revealing an executable file that appears legitimate. The executable loads additional payloads into memory, including a DLL named CreativeAI.dll containing encrypted code.

This DLL decrypts and injects the final version of the Phantom Stealer malware into the system.

Phantom Stealer Capabilities

Phantom Stealer is a comprehensive data theft tool with extensive capabilities. The malware features anti-analysis techniques that detect virtualized environments and security tools, automatically self-destructing if discovered.

According to Seqrite, it harvests cryptocurrency wallet data from both browser extensions and desktop applications, targeting dozens of known crypto wallets.

The stealer extracts Discord authentication tokens from browser databases and native Discord installations, validates them through Discord’s API, and collects user information, including usernames, emails, and Nitro subscription status.

It also deploys a continuous clipboard monitor that captures clipboard contents every second, logging timestamped entries for exfiltration.

Additional capabilities include a global keystroke logger using low-level Windows hooks, recovery of saved passwords and credit card data from Chromium-based browsers via SQLite database parsing, and targeted file collection based on predefined criteria.

Once stolen data is collected, Phantom Stealer packages it into a ZIP archive that includes system metadata, public IP addresses, and configuration toggles.

The malware employs multiple exfiltration channels, including Telegram bot APIs, Discord webhooks, and FTP servers with optional SSL support, ensuring attackers receive the stolen information through redundant communication methods.

Organizations should implement continuous filtering of containerized attachments, deploy memory-behavior monitoring solutions, and harden email security workflows for finance-facing departments to defend against these evolving threats.

IOCs

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.