Phantom StealerMalware
According to Proofpoint, this is a fork of Stealerium that has high overlap with its originating codebase.From MISP Galaxy
Last reported 2 months ago, by Group-IB2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1195Supply Chain Compromise
“The BEC that would have followed — the lateral phishing, the invoice fraud, the supply chain compromise — never materializes.”
- T1219Remote Access Tools
“Beyond email credentials, Group-IB Threat Intelligence also tracks compromised accounts for remote access tools like TeamViewer, AnyDesk, LogMeIn, Chrome Remote Desktop, and Parsec, which threat actors frequently use as alternative entry points after credential theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
No Room For Compromise: How Business Email Protection Predicts BEC Before It Starts“In a recent case tracked by Group-IB, a stealer-as-a-service operation called Phantom Stealer delivered five distinct attack waves against European logistics, manufacturing, and technology organizations, each designed to harvest credentials for exactly this kind of downstream exp…”
-
Phantom Stealer: Credential Theft as a Service“Phantom Stealer: Credential Theft as a Service”
Indicators in its reports
named in the reports above- scxzswx.lovestoblog[.]comin 1 report
- exczx[.]comin 1 report
- 108.171.108[.]248in 1 report
- 216.131.75[.]250in 1 report
- 195.177.94[.]6in 1 report
- 213.209.157[.]187in 1 report
- 185.147.214[.]250in 1 report
- 216.131.77[.]250in 1 report
- 216.131.112[.]239in 1 report
- 104.36.180[.]119in 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.