Executive Summary
A sustained phishing campaign is delivering Phantom Stealer, a sophisticated Malware-as-a-Service (MaaS) offering designed for stealthy credential and session theft. Explicitly linked to the North Korean threat actor Famous CHOLLIMA by security researchers, the campaign primarily targets the financial sector, logistics, manufacturing, and technology organizations across Europe and the Asia-Pacific regions.
The attack chain is notable for its use of heavily obfuscated, fileless execution techniques. The malware utilizes a complex dropper composed of Base64 encoding, XOR encryption, and the Donut shellcode generator to inject the final payload directly into the legitimate Windows Explorer process memory. This approach allows the adversary to bypass traditional signature-based defenses and maintain a minimal footprint on the host system.
The primary business risk involves the wholesale theft of browser-stored credentials, session cookies, and financial data. By capturing session tokens, attackers can bypass multi-factor authentication (MFA) to access sensitive SaaS platforms and online banking systems. The redundancy of its exfiltration infrastructure—utilizing Telegram, Discord, FTP, and SMTP—ensures a high success rate for data theft.