PhantomVAI Custom Loader Uses RunPE Utility to Attack Users

PhantomVAI is a custom loader observed in worldwide phishing campaigns that masquerades as legitimate software and uses a RunPE/Mandark process-hollowing technique to inject remote payloads (notably Remcos, XWorm, AsyncRAT, DarkCloud, and SmokeLoader) into Windows processes; researchers identified shared markers across samples (a "VAI" method, Portuguese strings, and impersonation of Microsoft.Win32.TaskScheduler.dll) and report the loader is likely offered as a service, allowing multiple threat actors to deploy diverse malware and complicating detection and attribution.