Unmasking the PhantomVAI Framework’s Fileless Assault on Corporate Defenses
ID: f280705c-068c-5241-ad50-312dd208660b
STIX ID: report--f280705c-068c-5241-ad50-312dd208660b
Feed Name: securityonline.info
Threat Score
LevelBlue SpiderLabs analyzed a modular, reusable malware framework (PhantomVAI) using obfuscated VBS launchers, fileless PowerShell, and base64-embedded .NET assemblies hidden inside PNGs; attackers staged payloads in open directories (/coupon/, /protector/, /invoice/) and deployed multiple malicious families (XWorm, Remcos RAT, RedLine Clipper, Kramer trojans) while leveraging Cloudflare-hosted resources to evade detection.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.