Abusing Trusted Business Workflows: A Multi-Stage Phantom Stealer Campaign

Reported 22 Jul 2026 by otx · Severity: medium

A sophisticated phishing campaign impersonates legitimate business entities including UPS and the Malaysian Inland Revenue Board to distribute Phantom Stealer v3.5.0. The attack begins with convincing emails containing compressed archives housing malicious JavaScript files. Once