Phantom Stealer Targets Russian Finance with ISO Phishing, Deploying Keyloggers and Crypto-Wallet Theft

A new phishing campaign aimed at Russia’s financial sector, dubbed Operation MoneyMount-ISO by Seqrite Labs, uses ISO-mounted executables to deliver the Phantom Stealer information-stealing malware, targeting finance, accounting and treasury departments with high-quality social engineering.

The attack starts with an email masquerading as a legitimate financial notice, with the subject line “Подтверждение банковского перевода” (Confirmation of Bank Transfer) and a sender claim that a payment has been transferred, supposedly from TorFX Currency Broker; the sender address is shown as achepeleva@iskra-svarka[.]ru.

To bypass filters, the email includes a ZIP containing an ISO file named “Подтверждение банковского перевода.iso” that auto-mounts, exposing a mounted drive from which the executable is launched to deploy Phantom Stealer. The malware then harvests data, including crypto-wallet information from browser extensions and desktop wallets, scans for Discord and Telegram tokens, extracts browser passwords, cookies and credit card data, and performs keylogging via a global keyboard hook, storing logs in a timestamped file.

Seqrite Labs warns this operation marks a strategic shift toward ISO-based initial access to evade perimeter controls and raises the risk of credential theft and unauthorised transfers for targeted organisations. According to Seqrite Labs, the campaign also features an AntiAnalysis class to detect security researchers and a SelfDestruct function to erase itself if analysis is detected.