Reported by 2 outlets

Timeline

1. original reporting

   Phishing, Cracked Software and Discord Links Spread Phantom Stealer Across Multiple Countries

   cyberpress.org · 61d ago · August 13th, 2026

   Phantom Stealer, a .NET-based information-stealing malware, is being distributed through phishing emails, pirated software downloads, and malicious links shared on Discord and Telegram. The malware is designed to silently collect browser credentials, saved passwords, cookies, cryptocurrency wallet data, system details, and other sensitive information from infected Windows devices. Security researchers have observed Phantom Stealer in campaigns targeting victims across several countries. Its modular structure, flexible delivery methods, and strong focus on credential theft make it a growing concern for both individuals and organizations. The malware is commonly delivered through phishing lures, trojanized applications , and malicious downloads that persuade users to launch an archive, script, or fake installer. Phantom Stealer Global Campaign Phantom Stealer uses multiple loaders to hide its final payload and reduce the chance of detection. One observed .NET loader conceals malicious content inside application resources, including PNG entries stored in a .NET resource manifest. The embedded payload is encrypted and only revealed after the loader decrypts it on the victim’s system. This steganography-based method makes simple file inspection more difficult and can delay static malware analysis. Another campaign used an obfuscated PowerShell script delivered through phishing email . The script dynamically compiled C# code, decoded shellcode, and injected it into explorer.exe , a

2. update from gbhackers.com

   Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials

   gbhackers.com · 61d ago · August 13th, 2026

   Phantom Stealer is a .NET-based credential-harvesting malware that combines PNG-backed payload concealment, PowerShell-driven process injection, and telemetry suppression to steal passwords, browser data, cryptocurrency wallets, and sensitive local files. The campaign illustrates how commodity infostealers are increasingly blending stealthy loaders with broad post-compromise collection capabilities. Its modular .NET architecture and accessible tooling make it usable […] The post Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .