Phantom v3.5 Alert: New Info-Stealer Disguised as Adobe Update Uses SMTP to Loot Digital Lives

Phantom v3.5 has emerged as an info-stealer masquerading as a routine software update, with analysis from K7 Security Labs detailing a fake “Adobe 11.7.7 installer” used to deploy a data-extraction toolkit. First detected in late October 2025, the campaign leverages a deceptive file named Adobe 11.7.7 installer.xml to trigger a PowerShell process that contacts a malicious domain (positivepay-messages[.]com) to download payload components.

Once on a victim’s machine, Phantom v3.5 acts as a digital vacuum, targeting passwords, browser cookies, credit card information, crypto wallet credentials, and IP addresses, among other data. It uses the Simple Mail Transfer Protocol (SMTP) to email stolen data directly to attackers, with SMTP credentials stored as a base64-encoded value and decrypted at runtime. The malware’s design includes the ability to exfiltrate via email rather than via Telegram bots or a dedicated C2 panel. Users are advised to verify software installers and download updates only from official vendor sites.