PhantomVAI Loader Delivers a Range of Infostealers

Unit 42 researchers describe PhantomVAI Loader as the evolved delivery mechanism behind a multi-stage phishing campaign that initially used Katz Stealer Loader and now distributes several infostealers including AsyncRAT, XWorm, FormBook and DCRat. The campaign uses obfuscated JavaScript and VBS, with a PowerShell stage that downloads a GIF or image concealing a Base64-encoded DLL which is then loaded by PhantomVAI Loader.

The loader, written in C#, performs virtual machine checks, establishes persistence and retrieves the final payload, injecting it into a target process such as MSBuild.exe using process hollowing.

Katz Stealer is described as MaaS, and the overall operation is said to be conducted by threat actors deploying PhantomVAI Loader in attacks worldwide across industries including manufacturing, education, utilities, technology, healthcare, information and government, with the loader now delivering additional strains alongside Katz Stealer.

According to VirusTotal, a phishing email campaign backed by obfuscated scripts and steganography forms the infection chain, which ultimately enables data exfiltration through the loaded infostealers.