Phantom Stealer Indicators

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•5

This rule detects the execution of processes with command lines containing indicators associated with 'Phantom Stealer' malware, such as 'phantom stealer', 'stealer.dll', 'phantom.exe', or 'phtantom'. This could indicate an attempt to load or execute the stealer.