Phantom Stealer Malware Hides in PNGs to Steal Credentials and Crypto
Phantom Stealer, a .NET-based malware, is leveraging steganography to conceal its payload within PNG image files, enabling it to steal sensitive data like passwords, cookies, and cryptocurrency from Windows systems.
A sophisticated malware strain known as Phantom Stealer is employing steganography to hide its malicious payload within seemingly innocuous PNG image files, significantly increasing its evasion capabilities. This .NET-based stealer is designed to target Windows systems, systematically collecting a wide array of sensitive information including user passwords, browser cookies, cryptocurrency wallet data, and other valuable credentials.
Attackers are distributing Phantom Stealer through various social engineering tactics, primarily via phishing emails, links to pirated software, and malicious messages circulated on platforms like Discord and Telegram. This broad distribution strategy makes it accessible to a wide range of potential victims, as an infection can occur with a single click on a tempting download or message.
Researchers at Splunk have identified Phantom Stealer as a modular malware, a design that enhances its flexibility and usability for both novice and experienced cybercriminals. The malware's ability to maintain persistence after a system restart, coupled with its capacity to gather browser data, cryptocurrency wallet information, files, and clipboard contents, makes it a potent threat.
The core of Phantom Stealer's evasion technique lies in its use of steganography, a method of hiding information within other files. In observed campaigns, a .NET loader embeds an encrypted executable within the resources of a PNG file. Upon execution, the loader decrypts this hidden payload, revealing the Phantom Stealer malware, thereby frustrating immediate file inspection and static analysis.
Once active, Phantom Stealer meticulously searches browser databases and configuration files for saved usernames, passwords, profiles, cookies, and payment card details. The theft of browser session cookies is particularly concerning, as it can grant attackers access to accounts even if multi-factor authentication is enabled, by bypassing the need for a password.
Beyond browser data, the malware also targets cryptocurrency wallet extensions and desktop applications. It actively monitors the clipboard for cryptocurrency wallet addresses, and has the capability to replace legitimate addresses with attacker-controlled ones, potentially diverting funds during user transactions. Its reach extends to stealing saved credentials from applications like FileZilla and WinSCP, Outlook profile information, screenshots, keystrokes, and Wi-Fi profiles.
To avoid detection, Phantom Stealer performs checks for sandbox environments or analysis tools. If it suspects it's being monitored, it can slow down or halt its operations. It also employs techniques such as launching Chrome with specific command-line arguments to isolate its activities from the victim's legitimate browser session, and can interfere with Windows security scanning and event logging to reduce its visibility.
Security professionals are advised to investigate unusual PowerShell activity, remote process injection, and non-browser applications accessing browser data. Additionally, vigilance against suspicious downloads and email attachments, along with prompt password and session credential rotation after a confirmed infection, are crucial mitigation steps.