TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Infosecurity Magazine

Phantom Project Bundles Infostealer, Crypter and RAT For Sale

2026-03-31 · Read original ↗

ATT&CK techniques detected

7 predictions
T1566.002Spearphishing Link
85%
“##ated a legitimate equipment trading company and used procurement - related subject lines designed to resemble business correspondence. messages were short, often only two to three sentences, and included professional - looking signature blocks to appear legitimate. read more on…”
T1566.002Spearphishing Link
75%
“phantom project bundles infostealer, crypter and rat for sale a. net - based infostealer sold as part of a commercial cybercrime toolkit that bundles a stealer, crypter and remote access tool ( rat ) under subscription tiers has been detailed further by cybersecurity researchers.…”
T1003OS Credential Dumping
75%
“, anti - analysis techniques and data exfiltration behavior. " phantom stealer is one example of a broader pattern, " the researchers explained, " credential theft scaling through commercial stealer - as - a - service operations, where the outcome is identity - driven compromise …”
T1566.001Spearphishing Attachment
56%
“phantom project bundles infostealer, crypter and rat for sale a. net - based infostealer sold as part of a commercial cybercrime toolkit that bundles a stealer, crypter and remote access tool ( rat ) under subscription tiers has been detailed further by cybersecurity researchers.…”
T1566.001Spearphishing Attachment
49%
“##ated a legitimate equipment trading company and used procurement - related subject lines designed to resemble business correspondence. messages were short, often only two to three sentences, and included professional - looking signature blocks to appear legitimate. read more on…”
T1589.001Credentials
40%
“, anti - analysis techniques and data exfiltration behavior. " phantom stealer is one example of a broader pattern, " the researchers explained, " credential theft scaling through commercial stealer - as - a - service operations, where the outcome is identity - driven compromise …”
T1566Phishing
36%
“phantom project bundles infostealer, crypter and rat for sale a. net - based infostealer sold as part of a commercial cybercrime toolkit that bundles a stealer, crypter and remote access tool ( rat ) under subscription tiers has been detailed further by cybersecurity researchers.…”

Summary

Phantom Stealer .NET harvests browser credentials, cookies, cards, sessions, as stealer-as-a-service