other

PhantomJack

Browser-hijacker malware family distributed as signed .msix packages posing as privacy and antivirus utilities, named in Trinity Cyber research.

Known aliases

Win32.Trojan.PhantomJack

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 publisher

A per-visit fingerprint check kept a live malware page rated clean for months

Daniel Jones of Tuxxin describes a landing page that fingerprints each visitor before it serves anything, so the reputation engines checking it from datacenter IPs recorded a harmless skeleton while real phones were handed a 148 MB installer.

Publishers:dev.to

Reality

Evidence52
Adoption35
Hype gap+18
Incentives70
Confidence48

build1 publisher

A lapsed Carnival promo domain routed authenticated booking mail into a cloaked malware network

A genuine Carnival booking confirmation passed SPF, DKIM and DMARC and pointed at a promotional domain the company had let lapse. Someone re-registered it, wired it into a cloaking network, and the link kept routing for 74 days.

Publishers:dev.to

Reality

Evidence62
Adoption42
Hype gap−12
Incentives30
Confidence57