APT / THREAT GROUP

PhantomVAI

aliases

Last seen:Mar 17, 2026

Intelligence Profile

PhantomVAI Loader is a malicious multi-stage infection chain used to distribute the Katz Stealer information-stealing malware or other malicious payloads.

Threat Analysis

PhantomVAI is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cyble.com/blog/stealth-in-layers-unmasking-loader-in-targeted-email-campaigns/

→https://unit42.paloaltonetworks.com/phantomvai-loader-delivers-infostealers/

→https://www.ibm.com/think/x-force/dcrat-presence-growing-in-latin-america

→https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

PhantomVAIVMDetectLoaderCaminhowin.phantomvaiKatz Stealer Loader

External Intelligence

Malpedia: win.phantomvai

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search PhantomVAI