Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

PhantomVAI Loader Delivers a Range of Infostealers

Summary: Unit 42 researchers are tracking phishing campaigns that use PhantomVAI Loader, formerly called Katz Stealer Loader or VMDetectLoader, to deliver infostealers through a multi-stage chain of obfuscated JavaScript or VBS attachments, Base64-encoded PowerShell, and payloads hidden in GIF images via steganography. The loader, first promoted by a user called katzadmin on BreachForums on April 13, 2025, now delivers AsyncRAT, XWorm, FormBook and DCRat in addition to Katz Stealer, and it checks for virtual machines before running and injects its payload into processes including MSBuild.exe.

Bottom line: Katz Stealer is sold as malware-as-a-service on underground forums and harvests passwords, networking data, emails and files from infected machines, so a single successful phishing email can hand credential and data theft to an operator who bought the tool rather than built it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related