From XLoader to Phantom Stealer: A DHL-Themed multi-stage Infection Chain

11 min read

Jan 27, 2026

Executive Summary

I have identified a multi-stage malware campaign delivering Phantom Stealer v3.5.0 via a DHL-themed spam email. Initial access occurs through a ZIP attachment masquerading as an invoice and requiring user execution. The archive drops a signed Java utility (jdeps.exe, renamed as DHL-INVOICE.exe) alongside a malicious jli.dll, identified as XLoader. Execution is achieved through DLL sideloading, allowing the trusted Java launcher to load the malicious DLL and transfer execution to the XLoader.

XLoader employs obfuscated, state-driven logic to parse embedded configuration, manually map an…