New Phantom Stealer Campaign Hits Windows Machines Through ISO Mounting

Operation MoneyMount-ISO is a phishing campaign delivering Phantom Stealer via ZIP/ISO attachments impersonating bank transfer confirmations to target finance and related departments in Russia. The malware auto-mounts ISO payloads, injects a DLL that decrypts and runs the stealer, and exfiltrates harvested data — including browser-saved credentials, crypto wallet data, Discord tokens, clipboard contents, and keystrokes — via Telegram, Discord webhooks, and FTP; the report includes IOCs and mitigation recommendations.