Phantom Goblin Uses Social Engineering Tactics to Deploy Stealer Malware

A sophisticated malware operation, dubbed “Phantom Goblin,” has been identified by cybersecurity researchers, highlighting the increasing use of social engineering tactics to deploy information-stealing malware.

This operation leverages deceptive techniques to trick users into executing malicious files, leading to unauthorized access and data theft.

Malware Distribution and Execution

The Phantom Goblin malware is distributed via RAR attachments, often delivered through spam emails.

These attachments contain a malicious shortcut (LNK) file disguised as a PDF document, named “document.lnk,” which is part of a RAR archive labeled “Proofs.rar.”

Once executed, the LNK file initiates a PowerShell command that silently downloads and executes additional payloads from a GitHub repository.

This ensures persistence by adding a registry entry, allowing the malware to run at system startup.

The payloads, including “updater.exe,” “vscode.exe,” and “browser.exe,” are designed to mimic legitimate applications, making them difficult to detect.

The malware primarily targets web browsers and developer tools for data theft and unauthorized system access.

It forcefully terminates browser processes to extract sensitive information such as cookies, login credentials, and browsing history.

The “updater.exe” payload steals cookies from browsers like Chrome, Brave, and Edge by enabling remote debugging, bypassing Chrome’s App Bound Encryption (ABE) for stealthy data exfiltration.

The stolen data is archived and transmitted to a Telegram channel using the Telegram Bot API.

Unauthorized Remote Access via VSCode Tunnels

Another critical aspect of the Phantom Goblin operation is its use of Visual Studio Code (VSCode) tunnels to establish unauthorized remote access.

The “vscode.exe” payload creates a VSCode tunnel, allowing threat actors to maintain control over compromised systems without triggering traditional security alerts.

According to CRIL Report, this is achieved by downloading a legitimate copy of VSCode, extracting it, and then using PowerShell scripts to create a tunnel.

The connection details are exfiltrated to a Telegram bot, enabling real-time remote access.

To mitigate these threats, users are advised to avoid opening unexpected attachments and to enable advanced email filtering.

Deploying robust endpoint protection with real-time threat detection can help identify malicious processes.

Restricting PowerShell execution and enforcing strict access controls for VSCode tunnels are also recommended.

Monitoring outbound network traffic for suspicious connections, including unusual Telegram API activity, can help detect and prevent such attacks.

By understanding these tactics, organizations can enhance their cybersecurity posture against sophisticated threats like Phantom Goblin.

Collect Threat Intelligence on the Latest Malware and Phishing Attacks with ANY.RUN TI Lookup -> Try for free