Sophisticated Phishing Campaign Deploys Phantom Stealer Malware via Fake Logistics and Tax Lures A multi-stage phishing campaign, documented by Seqrite, is targeting organizations by impersonating trusted entities including UPS Forwarding Hub and Malaysia’s Inland Revenue Board (LHDN) to deploy Phantom Stealer v3.5.0, a credential-harvesting malware. The campaign employs two distinct phishing lures: - Fake UPS shipment booking details, aimed at procurement teams, with malicious attachments disguised as legitimate documents (e.g., "UPS Docs_Shipment Number 3264010420-Quote ID 203263067.js"). - Fraudulent tax audit notices in Malay, pressuring finance staff to respond within a 14-day deadline. Both lures deliver a malicious JavaScript file inside a compressed archive, initiating a four-stage infection chain designed to evade detection: 1. Stage 1 (JavaScript): An obfuscated script decodes and executes a Base64-encoded PowerShell payload in memory, avoiding external downloads. 2. Stage 2 (PowerShell Loader 1): The payload decrypts an AES-encrypted next stage using embedded keys, executing it via `Invoke-Expression`. 3. Stage 3 (PowerShell Loader 2): Delivers an XOR-encrypted .NET injector (key: "DEVILboy56@@") and a PE file (confirmed via "MZ" header), which is reflectively loaded into aspnet_compiler.exe for in-memory execution. 4. Stage 4 (Phantom Stealer v3.5.0): The final payload harvests browser credentials, cookies, payment cards, cryptocurrency wallets, and messaging app data, categorizing stolen files (e.g., Chromium_passwords_<hostname>.txt). Data is exfiltrated via SMTP (port 587) using STARTTLS encryption, mimicking legitimate email traffic. The malware connects to an SMTP server (ruhi@aktekmetal[.]com[.]tr) with Base64-encoded credentials, sending stolen data before terminating with a QUIT command to avoid detection. No specific threat actor has been attributed, as Phantom Stealer is commodity malware widely available in cybercriminal markets. The campaign highlights attackers’ use of convincing business pretexts, layered obfuscation, and fileless execution to bypass traditional defenses. Indicators of Compromise (IOCs) include multiple file hashes and Seqrite detection signatures (e.g., Trojan.Injector.S39585891, PS.Trojan.Loader.50921.GC). Domains and IPs are defanged to prevent accidental resolution.

UPS found that between February 2022 and April 2023, the perpetrators of the persistent SMS phishing campaign used its package look-up capabilities to obtain access to delivery information, including the recipients' personal contact information. The company has now put protections in place to limit access to this sensitive data in order to combat these sophisticated phishing attacks. The recipient's name, the address to which the box was being shipped, and possibly the phone number and order number were all available information through the parcel look-up facilities. In order to maintain transparency and raise awareness of the issue, UPS will notify people whose information may have been compromised.