Critical

Russian Phishing Campaign Delivers Phantom Stealer Via ISO Files

Infosecurity Magazine

December 15, 2025 at 4:00 PM

Actively Exploited

Overview

A recent phishing campaign has been discovered that spreads the Phantom information-stealing malware through ISO file attachments. Attackers are targeting users by disguising these malicious files as legitimate content, tricking them into opening the files and executing the malware. Once installed, Phantom can collect sensitive information, including login credentials and personal data. This campaign poses a significant risk to individuals and organizations, as it can lead to data breaches and identity theft. Users should be cautious when receiving unsolicited emails with attachments, especially ISO files, and ensure their security software is up to date.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Users of email services and systems that can open ISO files, particularly those who engage with suspicious emails.
Action Required: Users should avoid opening ISO files from unknown sources, ensure email security filters are enabled, and keep antivirus software updated.
Timeline: Newly disclosed

Original Article Summary

A new phishing campaign has been identified, delivering the Phantom information-stealing malware via an ISO attachment

Impact

Users of email services and systems that can open ISO files, particularly those who engage with suspicious emails.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should avoid opening ISO files from unknown sources, ensure email security filters are enabled, and keep antivirus software updated.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Phishing, Malware.

Read Original Article

Related Coverage

Security Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs

A recent report indicates that North Korean IT workers have been using stolen U.S. identities to generate approximately $3 million. This situation raises serious concerns about identity theft and the extent of cyber operations conducted by North Korean entities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has noted this incident as part of a broader trend involving state-sponsored cybercriminal activities. Such actions not only threaten individuals whose identities were stolen but also pose risks to national security and international relations. As these cyber operations continue to evolve, they demonstrate the need for stronger identity verification measures and international cooperation to combat cybercrime.

Oct 18, 2026

Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed

Help Net Security

Last week, it was reported that a hidden implant was discovered in Ledger cryptocurrency wallets, which has been linked to a significant theft of around $93 million. This implant, likely used by cybercriminals, poses a serious risk to users' funds and security. Additionally, over 1,500 npm packages were found to be exposed, raising concerns about the safety of software dependencies in development environments. The incidents underscore vulnerabilities in widely used technologies, prompting users and developers to take immediate precautions to safeguard their assets and systems. As these incidents unfold, the importance of vigilance in cybersecurity practices becomes even clearer.

Oct 18, 2026

North Korean IT Workers Used Stolen US Identities to Earn $3 Million

Security Affairs

The FBI recently conducted raids on 40 homes in Texas as part of an investigation into a North Korean scheme that involved using stolen identities to create fake IT workers. These impostors targeted around 70 U.S. companies, helping the North Korean regime generate approximately $3 million. The Justice Department disclosed that two U.S. nationals were arrested in connection with this operation, which is part of a broader effort to disrupt North Korea's longstanding tactics of infiltrating American businesses. This incident raises significant concerns about identity theft and the potential for foreign interference in the U.S. economy, highlighting the vulnerabilities that companies face from sophisticated cyber schemes.

Oct 17, 2026

Drupal patches critical RCE flaws, warns exploits may emerge soon

BleepingComputer

Drupal has released patches for two serious vulnerabilities that could enable attackers to execute code remotely on any website running a supported version of its content management system. These vulnerabilities pose a significant risk, as they could allow unauthorized access and control over the affected sites. Users of Drupal are strongly advised to apply the patches immediately to protect their websites from potential exploitation. The urgency is underscored by the possibility that attackers may quickly develop exploits to take advantage of these vulnerabilities. Website administrators should prioritize this update to safeguard their systems and data.

Oct 17, 2026

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

SecurityWeek

A recent investigation revealed that Discover-Tech, an Israeli advertising firm, has been used as a conduit for Candiru's zero-click spyware. This spyware allows attackers to track and fingerprint devices without any user interaction, raising significant privacy concerns. The ads served by Discover-Tech can target specific individuals, making it easier for malicious actors to compromise their devices. This situation is alarming as it highlights the potential misuse of advertising technology for espionage and surveillance purposes, affecting the security of users who interact with these ads. As this information comes to light, it raises questions about how advertising platforms can be exploited and what measures need to be taken to protect users.

Oct 17, 2026

BAE Systems Cyber Incident Takes US Bankruptcy Noticing Center Offline for a Week

Security Affairs

A cyber incident at BAE Systems' US subsidiary has caused significant disruptions, taking the Bankruptcy Noticing Center offline since October 9. This outage has impacted the ability of bankruptcy courts across the United States to send out important notices, affecting both debtors and creditors involved in bankruptcy proceedings. The incident raises concerns about the security measures in place for critical infrastructure systems, especially those that handle sensitive legal and financial information. As the situation continues, it is crucial for BAE Systems to address the underlying issues to prevent future incidents and restore normal operations. The downtime has already delayed crucial notifications, which could have serious implications for ongoing bankruptcy cases.

Oct 17, 2026