<p“How do you trust a file that looks like an invoice?” That question — posed by researchers studying a different but instructive phishing campaign — now haunts defenders again as analysts identify a fresh wave of messages delivering the Phantom information‑stealing malware inside ISO attachments.
Phantom, an information stealer that harvests credentials, cookies and other sensitive artifacts, is being pushed in a phishing campaign that substitutes the more familiar ZIP and Office‑document lures with a mounted ISO image attached to email. When recipients mount or open the ISO, the malicious payload executes or drops a loader that fetches the Phantom stealer, giving attackers a relatively stealthy path to compromise endpoints and siphon valuable data.
Background: why ISO attachments are rising as an attacker choice
- ISO files are disk images that, when opened, appear to the operating system as removable media. That behavior can let executables run or autorun chains trigger in environments where users expect to open images, reducing suspicion.
- ISO attachments can bypass naïve gateway rules that flag .exe, .zip or Office documents, because the outer file appears to be a benign disk image rather than a direct executable container.
- Phishing authors routinely vary delivery mechanisms. Recent research into other campaigns shows attackers will migrate from ZIPs and image formats to whatever vector yields the highest click and execution rates; Seqrite Labs’ observation that “How do you trust a file that looks like an invoice?” captures the social‑engineering core of these operations .
What the current campaign looks like
Open‑source reporting and industry telemetry indicate the campaign typically begins with targeted emails that include legitimate‑looking lures — invoices, shipping notices or internal memos — with an attached ISO. Victims who mount the ISO see what looks like a document or installer; hidden inside is an executable or shortcut that launches a loader. That loader then pulls down Phantom, which enumerates local files and credentials, crawls browsers for saved cookies and passwords, and exfiltrates harvested data to attacker infrastructure.
Technical indicators defenders should watch for
- Unexpected .iso attachments in inbound mail, especially from external senders purporting to be invoices, procurement notices or HR documents.
- Users mounting disk images from email or network locations — particularly on machines without a legitimate business need to open ISOs.
- Post‑mount execution of unsigned binaries, suspicious PowerShell or command‑line activity that spawns network connections to uncommon domains or IPs.
- Outbound connections consistent with data exfiltration: irregular HTTPS/HTTP POSTs, use of uncommon ports, or long‑running connections to newly observed infrastructure.
Why this matters — from several vantage points
Technologists: The switch to ISOs shows attackers adapting to detection gaps. Security stacks that focus primarily on filetype blocking or signature matching for .doc/.zip/exe may miss a mounted image that presents as safe. Endpoint detection needs behavioral telemetry — process parents, mount events, and anomalous network flows — to detect the chain early.
Policymakers and leaders: Phishing remains a low‑cost, high‑yield vector for espionage and financial crime. Nation‑state and criminal groups alike profit when basic hygiene is poor. Investments in secure email gateways, mandatory multifactor authentication, and incident‑response capacity reduce the systemic risk posed by commodity stealers like Phantom.
Users and administrators: The immediate, practical defenses are straightforward and effective:
- Do not open or mount ISO (or other disk images) received unexpectedly via email. Verify with the sender through an independent channel.
- Apply the principle of least privilege: restrict who can mount images or install software, and use application allow‑listing where feasible.
- Enable MFA on critical accounts and monitor for credential‑use anomalies that indicate replay of stolen data.
- Harden email gateways to inspect carved or nested files and to sandbox attachments — including ISO content — prior to delivery.
Adversary perspective: why Phantom remains attractive
Information stealers like Phantom are profitable. They scale across many victims, require limited bespoke development, and feed a thriving resale market for credentials and session cookies. By improving delivery methods — in this case, leveraging ISO images — operators can expand reach with modest technical investment.
Context from other recent campaigns underscores the pattern: researchers have repeatedly observed attackers rotate file types and obfuscation techniques to evade detection and exploit human trust in familiar documents and invoices .
What defenders should do next
- Update email filtering rules to explicitly inspect and sandbox ISO attachments and other disk images.
- Train staff to recognize image and archive attachments as potential threats, and to validate any unexpected business documents off‑band.
- Deploy endpoint detection tuned to behavior rather than file signatures: monitor for mount events, cmd/Powershell spawning, and child processes that connect to unknown external hosts.
- Prepare playbooks for suspected credential theft: trigger password resets, revoke sessions, and perform threat hunts for lateral activity.
Conclusion
The maneuver is simple, the consequence real: a disc image that looks like a document can be a Trojan horse for credential theft and compromise. As defenders shore up one class of attachment, adversaries pivot to another. Will organizations treat the disk image as the new front line of social engineering, or will this latest delivery trick keep producing compromised accounts and costly investigations? The evidence — and the invoice‑style lures — suggest urgency.
Source: https://www.infosecurity-magazine.com/news/russian-phishing-phantom-stealer/
