PhantomVAI Custom Loader Abuses RunPE Utility to Launch Stealthy Attacks on Users

PhantomVAI is a custom Windows loader derived from the public Mandark/RunPE utility that uses process hollowing to inject downloaded payloads; it is being offered as a Loader-as-a-Service and has been observed in global phishing campaigns distributing RATs and information-stealing malware while employing stealth techniques (VM detection and masquerading as legitimate DLLs).