Digital Ghost: “PhantomVAI” Malware Revives Decade-Old RunPE Tricks

Intrinsec reports on PhantomVAI, a custom loader derived from an old RunPE utility used in worldwide campaigns to deliver infostealers and other payloads; it employs process hollowing and Windows Task Scheduler masquerading to evade detection, includes identifiable artifacts such as the namespace 'Hackforums.gigajew' and a component called Mandark (x64.load), and the report recommends enabling MFA and enhancing network monitoring to detect C2 activity and credential theft.