Phantom Stealer Spread by ISO Phishing Emails Hitting Russian Finance Sector

Cybersecurity researchers have disclosed an active phishing campaign targeting a wide range of sectors in Russia with phishing emails that deliver Phantom Stealer via malicious ISO optical disc images. The activity, codenamed Operation MoneyMount-ISO by Seqrite Labs, has primarily singled out finance and accounting entities, with procurement, legal and payroll departments also noted as secondary targets.

The campaign uses a fake payment confirmation lure to deliver the Phantom Stealer through a multi-stage attachment chain, beginning with a ZIP that downloads an ISO file and mounts as a virtual CD drive. The ISO image mounts Phantom Stealer via an embedded DLL, and the malware can extract data from cryptocurrency wallet extensions, grab browser passwords, tokens, cookies, and credit card details, while also monitoring the clipboard and keystrokes and checking for virtualised environments.

Exfiltration is achieved via a Telegram bot or attacker-controlled Discord webhook, and the stealer can transfer files to an FTP server. In recent months, the activity has extended to targeting Russian HR and payroll departments with an implant named DUPERUNNER and the AdaptixC2 framework, with the intrusion set attributed to UNG0902, and the broader campaign detected between June and September 2025. according to Seqrite.