Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials

Phantom Stealer is a .NET-based credential-harvesting malware that combines PNG-backed payload concealment, PowerShell-driven process injection, and telemetry suppression to steal passwords, browser data, cryptocurrency wallets, and sensitive local files.

The campaign illustrates how commodity infostealers are increasingly blending stealthy loaders with broad post-compromise collection capabilities.

Its modular .NET architecture and accessible tooling make it usable by a wide range of operators, turning a single endpoint compromise into a source of credentials, financial data, session material, and intelligence for follow-on attacks.

A notable loader variant hides its next-stage executable inside a PNG resource embedded in a .NET assembly. The PNG entry contains an encrypted data blob that is decrypted to reveal the final Phantom Stealer payload.

This implementation maps to MITRE ATT&CK’s T1027.003: Steganography and complicates static inspection because the malicious content is stored within otherwise ordinary application resources rather than exposed as a standalone executable.

Similar resource-steganography methods have previously appeared in malware such as Quasar RAT and LokiBot.

Splunk Threat Research Team said in a report shared with GBhackers, observed multiple Phantom Stealer delivery chains, including phishing emails, malicious links, cracked software, and lures distributed through Discord and Telegram.

Phantom Stealer Uses PNG Steganography

The script decrypts shellcode and injects it into explorer.exe using the familiar OpenProcess, VirtualAllocEx, WriteProcessMemory, VirtualProtectEx, and CreateRemoteThread sequence.

Another chain begins with an obfuscated PowerShell script that dynamically compiles C# code through Add-Type and uses randomized P/Invoke declarations to frustrate signature-based analysis.

This behavior corresponds to T1059.001: PowerShell and T1055: Process Injection.

The injected shellcode operates as a final-stage loader, unpacking Phantom Stealer inside a trusted Windows process.

The malware replaces the original clipboard content with an attacker-controlled wallet address embedded within the malware. This replacement address is stored in the code in an obfuscated form using Base64 encoding and AES-CBC encryption. 

It also patches AMSI and ETW functions, including AmsiScanBuffer, AmsiScanString, and EtwEventWrite, to weaken in-memory scanning and suppress telemetry that could expose the intrusion to endpoint detection and response platforms.

Once active, Phantom Stealer conducts extensive environment checks before beginning collection.

It examines hostnames, usernames, machine GUIDs, GPU names, running processes, services, and IP addresses for virtualization or sandbox artifacts. It also tests whether short delays are being skipped, a common signal of emulated analysis environments.

On endpoints it deems safe, the malware can create Chrome with --no-sandbox and --user-data-dir arguments, allowing it to operate in a controlled browser profile while evading normal session artefacts.

Its collection scope is broad. Phantom Stealer extracts Chromium and Gecko passwords, cookies, payment-card data, profiles, and browser-extension directories linked to cryptocurrency wallets.

It also targets desktop wallets, FileZilla and WinSCP credentials, Outlook profile data, Wi-Fi profiles, screenshots, keystrokes, clipboard contents, and selected documents.

Clipboard monitoring is particularly damaging: the malware can detect copied cryptocurrency addresses and replace them with attacker-controlled addresses, redirecting transactions without requiring account takeover.

Persistence is achieved through Registry Run keys or the Startup folder, while additional plugins may be fetched and injected after infection.

Detection should focus on behavior rather than payload hashes: monitor encoded or obfuscated PowerShell, runtime Add-Type compilation, suspicious remote-thread creation, unexplained access to browser credential stores, custom Chrome data directories, AMSI or ETW tampering, and abnormal access to WinSCP configuration paths.

Splunk has published 32 detections supporting investigation of the malware’s observed tradecraft.

IOCs

SHA-256	Description
b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32	Phantom Stealer Loader
382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961	Phantom Stealer Batch Loader
b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32	Phantom Stealer PowerShell Loader
be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab	Phantom Stealer JavaScript Loader

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now