Russian Threat Actors Deploy Phantom Stealer Using ISO Payloads

Du'aine Davis

Observed in the wild

• A Russian-origin phishing campaign, dubbed Operation MoneyMount-ISO, targeted finance-related roles (primary: Finance, Accounting, Treasury; secondary: Procurement, HR, SMEs) using fake payment confirmation emails. The attack began in early December 2025 and delivered the Phantom Stealer malware via a ZIP archive containing a malicious ISO file that auto-mounted and executed a disguised executable.
• The campaign leveraged ISO-mounted executables to bypass email security filters. The infection chain included DLL injection, encrypted payloads, and steganography. Phantom Stealer harvested browser credentials, crypto wallets, Discord tokens, clipboard data, and keystrokes, exfiltrating via Telegram, Discord webhooks, and FTP. The threat actors demonstrated advanced evasion techniques such as sandbox detection and self-deletion.
• Organisations should enforce strict filtering of containerised attachments (ZIP/ISO), monitor memory behaviour for reflective DLL loading, and harden finance-facing mail workflows. Microsoft Defender users should enable Attack Surface Reduction (ASR) rules to block executable content from email and removable drives, and configure Defender for Endpoint to detect suspicious ISO mounting and credential theft behaviours.

Operation MoneyMount-ISO — Deploying Phantom Stealer via ISO-Mounted Executables | Seqrite