other

Phantom Stealer

Windows information stealer marketed openly as a penetration testing tool and sold with a crypter, feature updates and round-the-clock support.

Current clusters

security1 publisher

Needle Stealer clears SmartScreen by shipping a Microsoft-signed OLEView copy in the ZIP

HP tracked the campaign from April to June 2026, in which a fake AI crypto trading agent shipped a genuine Microsoft utility to satisfy Windows reputation checks before the DLL loaded beside it stole browser wallet passwords.

Publishers:helpnetsecurity.com

Reality

Evidence60
Adoption40
Hype gap+15
Incentives70
Confidence55