Phantom Stealer Campaign Abuses UPS and Tax Audit Emails to Steal Credentials

A multi-stage phishing campaign that impersonates trusted business communications, including a global logistics provider and a government tax authority, to deploy Phantom Stealer v3.5.0, a credential-harvesting malware that exfiltrates data via SMTP. Documented by Seqrite , the campaign uses two distinct phishing lures sharing an identical infection chain. The first impersonates UPS Forwarding Hub, presenting fake shipment booking and quotation details to target procurement…