PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killer

PhantomStealer Infostealer Distributed via Phishing Campaign (TL-2026-2055), also tracked as Phantom Stealer, is a high-severity malware campaign, first published 2026-08-18. It has no confirmed attribution, affects Microsoft Windows, maps to 15 MITRE ATT&CK techniques (T1005, T1055.012, T1056.001), and is covered by 9 detection rules and 11 indicators of compromise.

Key facts for TL-2026-2055

Threat ID
TL-2026-2055
Also known as
Phantom Stealer
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-18
Last reviewed
2026-08-18
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
manufacturing, trade and import-export, professional services
Detection rules
9
Indicators of compromise
11

Malware and tooling in PhantomStealer Infostealer Distributed via Phishing Campaign

Malware and tooling: Phantom Stealer

ASEC reports an active phishing campaign impersonating overseas sales personnel requesting quote/version reviews. The lure delivers a multi-stage injector that chains three privilege-escalation techniques, drops the vulnerable driver DCRCVDrv.Sys (loaded as service NvStreamKmd_dcrcv) to kernel-terminate 180+ security products via IOCTL 0x2205C0, then process-hollows the PhantomStealer infostealer into AddInProcess32.exe to harvest credentials, browser/app data, cryptocurrency wallets, keystrokes, screenshots, and clipboard contents, exfiltrating over SMTP.

How PhantomStealer Infostealer Distributed via Phishing Campaign works

AhnLab ASEC (published 2026-08-12) documents a phishing campaign distributing an 'injector'-type malware whose lure impersonates overseas sales staff claiming a previously submitted quote needs revision and product-version verification, encouraging the recipient to open an attached archive (7200_Quantum_Enterprise_LLC_SSO-0661.GZ, extracting to 7200_Quantum_Enterprise_LLC_SSO-0661.Exe). The lure content — international sales/quote-verification correspondence — indicates targeting of organizations that process overseas B2B sales or procurement quotes (e.g. manufacturing, trade/import-export, and other functions handling supplier correspondence), though ASEC does not name specific victim organizations, sectors, or regions.

Once executed, the injector attempts SYSTEM-level privilege escalation through three chained techniques, tried in sequence until one succeeds: (1) an SSPI-based NTLM/Negotiate authentication relay against the local named pipe \\127.0.0.1\Pipe tsvcs to obtain a LocalSystem token via loopback impersonation; (2) invocation of the CMSTPLUA COM elevation moniker (Elevation:Administrator!New:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}) via CoGetObject to call ICMLuaUtil::ShellExec; and (3) a ShellExecuteExW call with the 'runas' verb as a last-resort UAC prompt.

With elevated privileges, the malware performs a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack: it drops the driver C:\Windows\Temp\DCRCVDrv.Sys, registers and loads it as the Windows service NvStreamKmd_dcrcv (exposing device object \\.\DCRCVDRV_U), and issues IOCTL 0x2205C0 to have the driver invoke kernel-mode ZwTerminateProcess against a target list of 180+ named security-product processes (e.g. MsMpEng.exe/Microsoft Defender, MsSense.exe/Defender for Endpoint, SecurityHealthService.exe, CSFalconService.exe/CrowdStrike Falcon, SentinelAgent.exe/SentinelOne, avp.exe/Kaspersky, ekrn.exe/ESET, bdagent.exe/Bitdefender, AvastSvc.exe, avgwdsvc.exe, MBAMService.exe/Malwarebytes, elastic-endpoint.exe, CylanceSvc.exe, and vendors including Norton and McAfee), bypassing user-mode tamper protection because the termination request originates from a signed kernel driver rather than a user-mode process.

With endpoint security disabled, the injector process-hollows the legitimate .NET utility C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe (VirtualAllocEx / WriteProcessMemory / ResumeThread) and executes the PhantomStealer payload inside it. PhantomStealer then harvests browser credentials and cookies from Chromium- and Gecko-based browsers plus stored credentials from FileZilla, FoxMail, WinSCP, and Outlook; collects cryptocurrency wallet data; logs keystrokes; takes screenshots; and monitors the clipboard, replacing copied cryptocurrency wallet addresses with attacker-controlled ones (a 'clipper' function) to redirect victim transactions. Collected data is exfiltrated over SMTP to mail.mnt.com:587 using the sender account phan@trimnt.com, i.e. the malware's own mail-protocol channel doubles as its C2/exfiltration path rather than a conventional HTTP(S) C2 server. ASEC's article does not cite a CVE, does not name a specific threat actor or intrusion group, and does not state that DCRCVDrv.Sys has a publicly documented CVE — it is abused for its legitimate (if dangerous) IOCTL-driven process-kill functionality rather than a memory-safety exploit.

'PhantomStealer' (also written 'Phantom Stealer') is reported elsewhere as a commodity/crimeware infostealer family distributed through multiple, apparently independent loader chains rather than a single fixed pipeline: this ASEC-documented campaign uses a GZ-archived injector with a BYOVD driver and CMSTPLUA/SSPI privilege escalation, while separately reported PhantomStealer/Phantom Stealer activity in the same period describes a different loader ('JSGuLdr') using JScript-triggered PowerShell to pull encrypted payloads from Google Drive and inject into msiexec.exe, and yet other reporting describes PNG-steganography-based loaders injecting into explorer.exe with AMSI/ETW tampering and VM/sandbox checks. These are noted here as family-level context for the PhantomStealer name only; none of their hashes, loaders, or C2 infrastructure are asserted to be part of this specific ASEC-documented BYOVD campaign, and are not included in this threat's IOC list.

MITRE ATT&CK techniques used in TL-2026-2055

Collection

T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture

Defense Evasion

T1055.012 Process Hollowing

Command and Control

T1071.003 Mail Protocols

Discovery

T1082 System Information Discovery

Privilege Escalation

T1134.001 Token Impersonation/Theft; T1548.002 Bypass User Account Control

Execution

T1204.002 Malicious File

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Persistence

T1543.003 Windows Service

Initial Access

T1566.001 Spearphishing Attachment

Impact

T1657 Financial Theft

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in PhantomStealer Infostealer Distributed via Phishing Campaign

  • Microsoft — Windows
    Vulnerable versions: Windows systems permitting installation/loading of the DCRCVDrv.Sys kernel driver as a service

Remediation for PhantomStealer Infostealer Distributed via Phishing Campaign

Immediate actions

  • Block/alert on outbound SMTP connections to mail.mnt.com:587 and any traffic referencing the sender domain trimnt.com at the email and network gateway
  • Hunt for and remove C:\Windows\Temp\DCRCVDrv.Sys and the Windows service NvStreamKmd_dcrcv (device object \\.\DCRCVDRV_U) on Windows endpoints
  • Alert on and quarantine hosts where AddInProcess32.exe was spawned with anomalous memory allocation, remote thread creation, or outbound network activity indicative of process hollowing
  • Alert on unexpected termination of security-agent processes (MsMpEng.exe, MsSense.exe, SecurityHealthService.exe, CSFalconService.exe, SentinelAgent.exe, avp.exe, ekrn.exe, bdagent.exe, AvastSvc.exe, avgwdsvc.exe, MBAMService.exe, elastic-endpoint.exe, CylanceSvc.exe) especially when preceded by new kernel service creation

Workarounds

  • Restrict which accounts/services can install or load kernel-mode drivers (limit local admin rights, enforce driver signature enforcement policy)
  • Disable or tightly scope the CMSTPLUA COM elevation moniker and named-pipe-based token impersonation where not required, via application control/EDR behavioral rules

Longer-term hardening

  • Deploy kernel driver blocklisting (Microsoft's vulnerable driver blocklist / HVCI, or WDAC driver allow-listing) to prevent loading of unrecognized or abusable signed drivers such as DCRCVDrv.Sys
  • Harden endpoint security agents with anti-tamper / self-protection features resistant to kernel-level process termination (BYOVD-aware EDR)
  • Enforce attachment sandboxing/detonation for archive attachments (.GZ and similar) at the email gateway, and flag emails impersonating overseas sales/quote-revision requests
  • For any host suspected of compromise, rotate browser-stored and application credentials (FileZilla, FoxMail, WinSCP, Outlook) and move cryptocurrency wallet funds to new wallets/keys

Timeline of PhantomStealer Infostealer Distributed via Phishing Campaign

  • AhnLab ASEC publishes technical analysis of the PhantomStealer BYOVD injector campaign.
  • Stolen data is exfiltrated over SMTP to mail.mnt.com:587 using the sender account phan@trimnt.com.
  • PhantomStealer harvests browser credentials/cookies, FileZilla/FoxMail/WinSCP/Outlook credentials, cryptocurrency wallet data, keystrokes, screenshots, and clipboard contents, substituting copied wallet addresses via its clipper function.
  • Injector process-hollows the legitimate AddInProcess32.exe (VirtualAllocEx/WriteProcessMemory/ResumeThread) to execute the PhantomStealer payload inside a trusted process.
  • Injector drops the vulnerable driver C:\Windows\Temp\DCRCVDrv.Sys, loads it as service NvStreamKmd_dcrcv, and issues IOCTL 0x2205C0 to kernel-terminate 180+ security product processes.
  • Injector attempts SYSTEM-level privilege escalation via SSPI/NTLM loopback authentication against \\127.0.0.1\Pipe\ntsvcs, then the CMSTPLUA COM elevation moniker (ICMLuaUtil::ShellExec), then a ShellExecuteExW 'runas' fallback.
  • Victim opens the malicious archive attachment 7200_Quantum_Enterprise_LLC_SSO-0661.GZ, extracting and executing the injector 7200_Quantum_Enterprise_LLC_SSO-0661.Exe.
  • ASEC identifies an active phishing campaign distributing PhantomStealer via email impersonating overseas sales personnel requesting a quote/product-version review.

Sources cited for PhantomStealer Infostealer Distributed via Phishing Campaign

Threats related to PhantomStealer Infostealer Distributed via Phishing Campaign

Detection coverage for TL-2026-2055

As of 2026-08-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2055 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats