How a malware-as-a-service platform combines credential theft, obfuscation and remote access to support identity-focused cybercrime operations
Key takeaways
- Phantom Project bundles multiple attack capabilities into a single service. The platform combines an infostealer, a crypter, and an advertised remote access tool (RAT), reflecting the growing professionalization of the malware-as-a-service ecosystem.
- Phantom Stealer has evolved into an identity-theft platform. Recent versions target browser credentials, cookies, payment information, messaging applications, cryptocurrency wallets, and other sources of authentication data that can enable account takeover and further attacks.
- Modern Phantom campaigns rely on sophisticated phishing and fileless execution techniques. Researchers have documented multi-stage JavaScript and PowerShell infection chains, reflective .NET loading, and in-memory execution designed to evade traditional security controls.
Phantom Project is a commercial cybercrime toolkit that bundles a stealer, a crypter and a remote access tool (RAT). It follows the standard Malware-as-a-Service (MaaS) model with tiered subscriptions for basic and advanced access. Researchers have observed the toolkit in Russian- and English-language phishing campaigns targeting users in more than 100 countries. Phantom Project activity was first observed in June 2025, though researchers found its distribution site had been registered in February of that year. Phantom Project activity accelerated through the second half of 2025, with multiple independent research teams documenting separate global campaigns within the same several-month window.
Phantom Project is said to include three core components, but only two appear to have been observed in attacks. The Phantom Stealer is the infostealer and the workhorse of the bundle. Phantom Crypter packs and obfuscates the Phantom Stealer payload to help evade security controls. The Phantom RAT is advertised on the website, but there has been little evidence of deployment in observed campaigns.
Together, the crypter, stealer and remote access trojan (RAT) provide threat actors with tools for malware delivery, credential theft and long-term access. This type of bundling reflects a trend in the cybercrime economy toward MaaS offerings that combine multiple stages of attack in one subscription. Many of these bundles have included an infostealer and either a crypter, loader or RAT. Another common bundle is a loader, crypter and RAT. Phantom Project is notable because the traditional loader is replaced with an infostealer.
Why the infostealer? A loader provides a threat actor with access to a device, but an infostealer provides identity. For example, if you steal a user's browser cookies and authentication tokens, you may gain access to Microsoft 365, Google Workspace, cloud storage, CRM systems, and other SaaS platforms without needing persistent access to a device. Recent Phantom campaigns have specifically targeted browser credentials, cookies, autofill data, and session information.
The Phantom stealer component has continued to evolve as an identity-theft platform since its emergence in 2025. Developers expanded the stealer’s browser targeting to include Chrome, Edge, Firefox, and other Chromium- and Gecko-based browsers, and added greater data collection capabilities. Phantom Stealer v3.5.0 has been observed in multiple global campaigns throughout 2026, including phishing operations targeting banking, manufacturing, procurement, logistics, and finance personnel.
Researchers have also documented increasingly sophisticated delivery chains that use multi-stage infection chains and fileless execution techniques designed to evade security controls.
Defend yourself
Phantom Stealer's success depends heavily on stealing credentials and getting users to open malicious files. That makes strong email security, phishing-resistant multifactor authentication (MFA) and careful monitoring of account activity some of the most effective defenses available. IT teams should also watch for unusual outbound connections and data transfers, especially to unfamiliar cloud services. Phantom Stealer has been observed exfiltrating data through multiple channels simulataneously, including SMTP, FTP, Telegram, and Discord. Monitor for these and any other connections to unfamiliar services.
2026 Email Threats Report
Learn how AI and phishing-as-a-service are reshaping the email threat landscape and how to stay protected
Subscribe to the Barracuda Blog.
Sign up to receive threat spotlights, industry commentary, and more.
The Managed XDR Global Threat Report
Key findings about the tactics attackers use to target organizations and the security weak spots they try to exploit