# PhantomStealer Infostealer Distributed via Phishing Campaign with BYOVD Security Software Killer

> ASEC reports an active phishing campaign impersonating overseas sales personnel requesting quote/version reviews. The lure delivers a multi-stage injector that chains three privilege-escalation techniques, drops the vulnerable driver DCRCVDrv.Sys (loaded as service NvStreamKmd_dcrcv) to kernel-terminate 180+ security products via IOCTL 0x2205C0, then process-hollows the PhantomStealer infostealer into AddInProcess32.exe to harvest credentials, browser/app data, cryptocurrency wallets, keystrokes, screenshots, and clipboard contents, exfiltrating over SMTP.

- **Published:** 2026-08-18T00:00:00Z
- **Last reviewed:** 2026-08-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2055
- **ID:** TL-2026-2055
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab ASEC (published 2026-08-12) documents a phishing campaign distributing an 'injector'-type malware whose lure impersonates overseas sales staff claiming a previously submitted quote needs revision and product-version verification, encouraging the recipient to open an attached archive (7200_Quantum_Enterprise_LLC_SSO-0661.GZ, extracting to 7200_Quantum_Enterprise_LLC_SSO-0661.Exe). The lure content — international sales/quote-verification correspondence — indicates targeting of organizations that process overseas B2B sales or procurement quotes (e.g. manufacturing, trade/import-export, and other functions handling supplier correspondence), though ASEC does not name specific victim organizations, sectors, or regions.

Once executed, the injector attempts SYSTEM-level privilege escalation through three chained techniques, tried in sequence until one succeeds: (1) an SSPI-based NTLM/Negotiate authentication relay against the local named pipe \\127.0.0.1\Pipe\ntsvcs to obtain a LocalSystem token via loopback impersonation; (2) invocation of the CMSTPLUA COM elevation moniker (Elevation:Administrator!New:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}) via CoGetObject to call ICMLuaUtil::ShellExec; and (3) a ShellExecuteExW call with the 'runas' verb as a last-resort UAC prompt.

With elevated privileges, the malware performs a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack: it drops the driver C:\Windows\Temp\DCRCVDrv.Sys, registers and loads it as the Windows service NvStreamKmd_dcrcv (exposing device object \\.\DCRCVDRV_U), and issues IOCTL 0x2205C0 to have the driver invoke kernel-mode ZwTerminateProcess against a target list of 180+ named security-product processes (e.g. MsMpEng.exe/Microsoft Defender, MsSense.exe/Defender for Endpoint, SecurityHealthService.exe, CSFalconService.exe/CrowdStrike Falcon, SentinelAgent.exe/SentinelOne, avp.exe/Kaspersky, ekrn.exe/ESET, bdagent.exe/Bitdefender, AvastSvc.exe, avgwdsvc.exe, MBAMService.exe/Malwarebytes, elastic-endpoint.exe, CylanceSvc.exe, and vendors including Norton and McAfee), bypassing user-mode tamper protection because the termination request originates from a signed kernel driver rather than a user-mode process.

With endpoint security disabled, the injector process-hollows the legitimate .NET utility C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe (VirtualAllocEx / WriteProcessMemory / ResumeThread) and executes the PhantomStealer payload inside it. PhantomStealer then harvests browser credentials and cookies from Chromium- and Gecko-based browsers plus stored credentials from FileZilla, FoxMail, WinSCP, and Outlook; collects cryptocurrency wallet data; logs keystrokes; takes screenshots; and monitors the clipboard, replacing copied cryptocurrency wallet addresses with attacker-controlled ones (a 'clipper' function) to redirect victim transactions. Collected data is exfiltrated over SMTP to mail.mnt.com:587 using the sender account phan@trimnt.com, i.e. the malware's own mail-protocol channel doubles as its C2/exfiltration path rather than a conventional HTTP(S) C2 server. ASEC's article does not cite a CVE, does not name a specific threat actor or intrusion group, and does not state that DCRCVDrv.Sys has a publicly documented CVE — it is abused for its legitimate (if dangerous) IOCTL-driven process-kill functionality rather than a memory-safety exploit.

'PhantomStealer' (also written 'Phantom Stealer') is reported elsewhere as a commodity/crimeware infostealer family distributed through multiple, apparently independent loader chains rather than a single fixed pipeline: this ASEC-documented campaign uses a GZ-archived injector with a BYOVD driver and CMSTPLUA/SSPI privilege escalation, while separately reported PhantomStealer/Phantom Stealer activity in the same period describes a different loader ('JSGuLdr') using JScript-triggered PowerShell to pull encrypted payloads from Google Drive and inject into msiexec.exe, and yet other reporting describes PNG-steganography-based loaders injecting into explorer.exe with AMSI/ETW tampering and VM/sandbox checks. These are noted here as family-level context for the PhantomStealer name only; none of their hashes, loaders, or C2 infrastructure are asserted to be part of this specific ASEC-documented BYOVD campaign, and are not included in this threat's IOC list.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1548.002 Bypass User Account Control
- T1134.001 Token Impersonation/Theft
- T1543.003 Windows Service
- T1685 Disable or Modify Tools
- T1055.012 Process Hollowing
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.001 Keylogging
- T1113 Screen Capture
- T1005 Data from Local System
- T1082 System Information Discovery
- T1071.003 Mail Protocols
- T1657 Financial Theft

## Sources

- [PhantomStealer distribution campaign using injector-type malware (BYOVD)](https://asec.ahnlab.com/en/95000/)
- [MalwareBazaar sample entry (PhantomStealer)](https://bazaar.abuse.ch/sample/00ad2a4a6811ffe57ef26471e0471f036c15ebad8e9526be7c54ae40b9e066ed/)
- [PhantomStealer Malware removal guide](https://www.pcrisk.com/removal-guides/34390-phantomstealer-malware)
- [Phishing, Cracked Software and Discord Links Spread Phantom Stealer Across Multiple Countries](https://cyberpress.org/phantom-stealer-global-campaign/)
- [Phantom Stealer Uses PNG Steganography and PowerShell Injection to Steal Credentials](https://gbhackers.com/phantom-stealer-uses-png-steganography/)
- [Phantom Stealer Analysis: Inside a Two-Layer Attack Chain](https://socprime.com/active-threats/phantom-stealer-analysis-inside-a-two-layer-attack-chain/)
- [PhantomVAI Loader Delivers a Range of Infostealers](https://unit42.paloaltonetworks.com/phantomvai-loader-delivers-infostealers/)
- [Phantom Project Bundles Infostealer, Crypter and RAT For Sale](https://www.infosecurity-magazine.com/news/phantom-project-infostealer-nov-25/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2055