Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Phantom Stealer Malware Analysis: Targets & TTPs

Phantom Stealer

Also known as:Phantom StealerPhantom stealer v2.0

What is the Phantom Stealer infostealer, and what data does it steal?

Phantom Stealer (also known as Phantom Stealer and Phantom stealer v2.0) is an information-stealing malware family operating under the MaaS model. Phantom Stealer targets browser credentials, cryptocurrency wallets, Telegram/Discord session tokens, Windows product key extraction, Desktop screenshot capture, Banking / crypto / adult site domain detection summary, System hardware (CPU, GPU, RAM, screen, webcam, power) inventory and Network info (gateway, internal, external IP). As of 11/10/2026, CyStack's research records 3 variants distributed through 2 channels, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

Phantom Stealer is a Stealerium-fork info-stealer sold as a MaaS through the phantomsoftwares.site storefront and the @Phantomsoftwares_bot Telegram marketplace, contact handle @Oldphantomoftheopera. Public reporting documents the family as active since February 2025 with a NativeAOT pdh.dll outer loader plus a .NET inner payload (two-layer attack chain).

This catalog documents two distinct Information.txt panel shapes:

v2 emoji-section panel (canonical, publicly confirmed): banner *Phantom stealer v2.0 - Report:* with 📅 Date:, 🖥️ System:, 💻 CompName:, 🌐 External IP: field lines organised under *HARDWARE INFORMATION* / *NETWORK INFORMATION* / *DETECTED DOMAINS* / *BROWSER DATA* / *SOFTWARE & ACCOUNTS* / *DEVICE INFORMATION* / *INSTALLATION STATUS* Markdown-bold section banners separated by U+2501 heavy horizontal ━ rules. Trailing operator-attribution block carries contact / marketplace / website URLs. - v1 flat key-colon-value UserInformation.txt layout (Username: / PC-name: / Ip: / Location: / System: / Admin rights:). The v1 layout was originally flagged as provisionally-attributed Phantom; the v2 emoji-panel research has not directly confirmed the v1 key-value shape, so v1 attribution remains tentative even though it is retained under the same canonical family pending a published mapping.

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Operator panels & distribution channels

2 distinct distribution channels recorded for this malware

Panel name	Distribution channel	Confidence
ph********	Telegram	High
—	Telegram	High

Data is masked to protect the community

The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Variants (3)

3 variants recorded for this malware

ID	Data collected	Confidence
`44219ba...`	1	High
`644d60f...`	36	High
`c63d400...`	5	High

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence