Phantom Stealer Spread by ISO Phishing Emails Hitting Russian Finance Sector
Cybersecurity experts have revealed information on an ongoing phishing attempt that targets several Russian industries using phishing emails that use malicious ISO optical disc images to deploy Phantom Stealer.
The action, which Seqrite Labs nicknamed Operation MoneyMount-ISO, has mostly targeted finance and accounting organizations, with payroll, legal, and procurement verticals emerging as secondary targets.
According to the cybersecurity firm, this operation uses a phony payment confirmation enticement to spread the Phantom information-stealing malware via a multi-stage attachment chain.
Phishing emails that pose as authentic financial correspondence and ask recipients to verify a recent bank transfer are the first step in the infection chain. A ZIP archive that seems to have ...