Analytics Story: Phantom Stealer

Updated Date: 2026-06-24 ID: 9647c6d9-3245-41b6-b519-894956279304 Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Phantom Stealer is an information-stealing malware designed to covertly harvest sensitive data from compromised Windows endpoints.

It primarily targets browser credential stores, saved passwords, cookies, autofill data, and session tokens from popular browsers such as Chrome, Edge, and Firefox.

Beyond browsers, Phantom Stealer extends its reach to FTP and SSH clients, including WinSCP, FileZilla, and PuTTY, as well as email clients, cryptocurrency wallets, and VPN configurations.

The malware commonly arrives via phishing emails, trojanized software, or malicious downloads.

Once executed, it enumerates the victim system, collects targeted data, archives the harvested output, and exfiltrates it to attacker-controlled infrastructure over encrypted channels. Phantom Stealer leverages access to sensitive application configuration folders — including WinSCP security directories — to extract stored credentials outside of normal application access patterns.

Detection focuses on unauthorized process access to credential storage paths, abnormal file reads from browser and FTP client profile directories, and suspicious data archiving or outbound connection behavior.

Why it matters

In observed Phantom Stealer campaigns, the malware is typically delivered through phishing lures or cracked software bundles targeting Windows users.

Upon initial execution from a user profile or temporary directory, the malware rapidly enumerates installed applications and begins accessing sensitive credential stores.

Telemetry captured unauthorized reads of WinSCP security configuration folders by non-WinSCP processes, a strong behavioral indicator of credential harvesting targeting SSH and FTP sessions.

The malware similarly accessed browser profile directories for Chrome and Edge, extracting Login Data, Cookies, and Web Data SQLite databases containing saved credentials and session tokens.

Following collection, Phantom Stealer compressed the harvested data into an archive and transmitted it via HTTPS POST to its command-and-control server.

In some cases, persistence was observed through registry run key modifications, ensuring the stealer re-executes after reboot.

The breadth of targeted applications — spanning browsers, file transfer clients, and crypto wallets — makes Phantom Stealer a high-impact credential theft tool capable of enabling account takeover, financial fraud, and further intrusion into enterprise environments.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Credentials from Password Stores Chrome Extension Access	Query Registry	Anomaly
Windows Disable or Stop Browser Process	Disable or Modify Tools	TTP
PowerShell PInvoke Process Injection API Chain	Dynamic-link Library Injection, Thread Execution Hijacking, Asynchronous Procedure Call, Process Hollowing, Process Doppelgänging, PowerShell, Reflective Code Loading	TTP
Suspicious Process With Discord DNS Query	Visual Basic	Anomaly
Windows Credentials from Password Stores Chrome Login Data Access	Query Registry	Anomaly
Windows Unusual FileZilla XML Config Access	Credentials In Files	Anomaly
PowerShell 4104 Hunting	PowerShell	Hunting
Windows Boot or Logon Autostart Execution In Startup Folder	Registry Run Keys / Startup Folder	Anomaly
Windows Process Injection Remote Thread	Portable Executable Injection	TTP
Windows Unusual Process Load Mozilla NSS-Mozglue Module	CMSTP	Anomaly
Powershell Fileless Script Contains Base64 Encoded Content	Obfuscated Files or Information, PowerShell	TTP
Windows Unsecured Outlook Credentials Access In Registry	Unsecured Credentials	Anomaly
Windows File Transfer Protocol In Non-Common Process Path	Mail Protocols	Anomaly
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
Windows Browser Process Launched with Unusual Flags	Browser Session Hijacking	Anomaly
Windows Disable or Modify Tools Via Taskkill	Disable or Modify Tools	Anomaly
Windows Credential Access From Browser Password Store	Query Registry	Anomaly
Non Firefox Process Access Firefox Profile Dir	Credentials from Web Browsers	Anomaly
Windows Powershell Cryptography Namespace	PowerShell	Anomaly
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
Windows Credentials from Password Stores Chrome LocalState Access	Query Registry	Anomaly
Windows Credentials from Password Stores Chrome Copied in TEMP Dir	Credentials from Web Browsers	TTP
Windows DNS Query Request by Telegram Bot API	DNS, Bidirectional Communication	Anomaly
Windows System Network Connections Discovery Netsh	System Network Connections Discovery	Anomaly
Headless Browser Usage	Virtualization/Sandbox Evasion, Hidden Window	Anomaly
Windows Chromium Browser with Custom User Data Directory	Virtualization/Sandbox Evasion	Anomaly
Windows Non Discord App Access Discord LevelDB	Query Registry	Anomaly
Windows Process Injection With Public Source Path	Portable Executable Injection	Hunting
Windows WinSCP Configuration Security Access	Credentials In Files	Anomaly
Non Chrome Process Accessing Chrome Default Dir	Credentials from Web Browsers	Anomaly
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Windows Chromium Browser No Security Sandbox Process	Virtualization/Sandbox Evasion	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Windows Event Log Security 4663	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 8	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 3	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

Source: GitHub | Version: 1