Phantom Stealer Malware Hides in PNGs to Steal Credentials

Key Takeaways

• Phantom Stealer is a credential-stealing malware leveraging steganography to hide its payload within PNG image files.
• It targets Windows systems to extract sensitive data, including passwords, browser cookies, cryptocurrency wallet information, and various personal files.
• Initial infections typically occur via phishing emails, pirated software, and malicious links shared on platforms like Discord and Telegram.
• The malware employs anti-analysis techniques, such as sandbox detection, to evade detection during security investigations.
• Organizations and individuals should implement robust security practices, including vigilant email handling, unauthorized software blocking, and prompt credential rotation after a suspected compromise.

Phantom Stealer Leverages PNG Steganography for Covert Credential Theft

A new credential-stealing malware, dubbed Phantom Stealer, has been identified employing an advanced steganography technique to embed its malicious payload within seemingly innocuous PNG image files. This sophisticated approach allows the malware to evade detection while systematically exfiltrating sensitive data from compromised Windows systems.

Researchers at Splunk have detailed how Phantom Stealer operates as a .NET-based information stealer, featuring a modular architecture that makes it accessible to a wide range of threat actors, from novice to experienced cybercriminals. Its capabilities extend to harvesting passwords, browser cookies, cryptocurrency wallet data, and other critical user information.

Attack campaigns utilizing Phantom Stealer have been observed globally. Threat actors typically disseminate the malware through common social engineering vectors, including phishing emails, distribution of pirated software, and malicious links shared across popular communication platforms like Discord and Telegram. A single click on a deceptive link or download can initiate the infection chain.

The flexibility of Phantom Stealer presents significant risks. Stolen session cookies, for instance, can enable unauthorized access to user accounts without requiring the actual password, effectively bypassing multi-factor authentication in some scenarios. Furthermore, the theft of cryptocurrency wallet data can lead to direct and irreversible financial losses for victims, as Splunk said in a report shared with Cyber Security News (CSN).

How Phantom Stealer Hides Its Malicious Payload

The core innovation of Phantom Stealer lies in its use of steganography. While the PNG file itself may not always be the initial vector, it serves as a crucial hiding spot for the malware’s subsequent stages. In one observed attack sequence, a .NET loader was found to store an encrypted executable within a PNG resource embedded in its own structure. This encrypted data is only decrypted and executed after the loader has initiated, making quick file inspections challenging and increasing the malware’s stealth.

Steganography, the practice of concealing information within another message or file, is particularly effective with image files due to their ubiquitous nature and the inherent trust users place in them. This technique has been observed in other recent campaigns, where seemingly normal graphics secretly carried malicious code designed to bypass traditional security scanners.

Another infection vector involves a heavily obfuscated PowerShell script delivered via phishing emails. This script decrypts and injects malicious code into legitimate Windows processes, such as explorer.exe. From this vantage point, it can deploy the final stealer payload and actively undermine system visibility by disrupting Windows security scanning and event logging mechanisms.

Analysis of the malware has shown the successful extraction of next-stage content from within image files. This underscores a crucial takeaway for defenders: while an image file might appear benign, any unusual image resources coupled with suspicious script activity warrant immediate and thorough investigation.

Passwords, Cookies, and Crypto Assets at High Risk

Once activated on a system, Phantom Stealer systematically targets a broad array of sensitive data. It meticulously scans browser databases and configuration files for stored usernames, passwords, user profiles, session cookies, and payment card details. The compromise of session cookies is particularly concerning, as it allows attackers to hijack authenticated web sessions, thereby circumventing multi-factor authentication (MFA) and gaining direct access to user accounts.

Beyond browser data, the malware specifically targets cryptocurrency assets. It copies data from both browser extensions and desktop applications associated with cryptocurrency wallets. Furthermore, it actively monitors the victim’s clipboard for wallet addresses. If an address is detected, Phantom Stealer can surreptitiously replace it with an attacker-controlled address, leading to misdirected payments when the victim pastes the copied information.

Phantom Stealer’s data exfiltration capabilities extend beyond web browsers and crypto wallets. Researchers have observed it searching for specific documents, databases, FileZilla settings, saved WinSCP credentials, Outlook profile information, and even capturing screenshots and logged keystrokes. It also collects saved Wi-Fi profiles. To maintain persistence, the malware establishes a Registry Run entry or places itself in the Startup folder, ensuring it relaunches automatically after a system reboot.

To evade detection and analysis, Phantom Stealer incorporates anti-sandbox and anti-analysis checks. It queries system, account, process, service, and network details to identify virtualized environments. If a sandbox is suspected, the malware can slow down or halt its operations, making it challenging for security researchers to fully observe its behavior. It also initiates Chrome with specific command-line settings to isolate its operations from the victim’s legitimate browser sessions, further hindering detection.

What You Should Do

• Monitor for Anomalous Activity: Investigate any unusual PowerShell script execution, remote process injection, non-browser applications attempting to access browser data, or browser instances launched with custom user-data directories or “no-sandbox” settings.
• Enhance Email and Download Security: Implement stringent security measures for email attachments and suspicious downloads. Educate users on identifying phishing attempts and the risks associated with downloading unauthorized or pirated software.
• Block Unauthorized Software: Enforce policies to prevent the installation and execution of unauthorized software on endpoints.
• Implement Endpoint Detection and Response (EDR): Deploy EDR solutions capable of detecting advanced threats, including those employing steganography and anti-analysis techniques.
• Regularly Update and Patch Systems: Ensure all operating systems, applications, and security software are kept up-to-date with the latest patches to mitigate known vulnerabilities.
• Rotate Credentials: In the event of a confirmed infection, immediately rotate all affected passwords, invalidate active browser sessions, and secure cryptocurrency wallet credentials. All affected assets should be treated as compromised without delay.
• Review IoCs: Utilize the provided Indicators of Compromise (IoCs) in your security information and event management (SIEM) systems and threat intelligence platforms to detect and block known variants of Phantom Stealer.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.