PhantomVAI Loader Launches Global Campaign to Distribute AsyncRAT, XWorm, FormBook, and DCRat

PhantomVAI Loader, a newly renamed multi-stage .NET loader tracked by Unit 42, is being used in widespread phishing campaigns to deliver AsyncRAT, XWorm, FormBook and DCRat payloads. It was initially identified as Katz Stealer Loader for deploying the Katz Stealer infostealer, and researchers say the loader now supports a broader repertoire through an evasive infection chain that uses obfuscated scripts, steganography and virtual-machine detection.

On 13 April 2025, Katz Stealer emerged on underground forums as a malware‑as‑a‑service offering designed to harvest credentials, browser data, cryptocurrency wallets and communication logs, and later campaigns renamed Katz Stealer Loader and VMDetectLoader as capabilities expanded.

The PhantomVAI infection chain unfolds in three stages: a phishing email delivering a script, a steganographic PowerShell stage hidden inside an image, and the final PhantomVAI Loader execution that downloads and injects AsyncRAT, XWorm, FormBook or DCRat into a legitimate executable such as MSBuild.exe. The loader employs VM detection to abort in sandboxes and then establishes persistence before pulling down the final payload.

It is sold on underground marketplaces as malware‑as‑a‑service, enabling lower‑skill actors to initiate complex attacks, according to Unit 42. If compromise is suspected, organisations are advised to contact the Unit 42 Incident Response team for rapid containment and remediation.