PhantomVAI Loader Uses Steganography in Phishing Attacks

A new multi-stage malware loader, dubbed PhantomVAI Loader, is being distributed through widespread phishing campaigns to deliver various information-stealing malware. The attack begins with a malicious script in a phishing email, which then uses steganography to download the loader by hiding it within a seemingly harmless image file. Once active, the .NET-based loader performs virtual machine checks to evade analysis before establishing persistence on the compromised system. It then downloads and injects its final payload, such as AsyncRAT, XWorm, or Katz Stealer, into a legitimate system process to bypass security defenses. This malware-as-a-service tool targets a wide range of industries globally, demonstrating a sophisticated and evasive infection chain used by threat actors.