PhantomStealer Injector + Mirage2FA AitM PhaaS: OTX Pulse Analysis — Credential Theft Detection Pack | Security Arsenal

Two converging credential-theft operations surfaced in today's OTX feed, and together they map the full modern identity-compromise kill chain — endpoint-level infostealer deployment on one side, and session-token theft that renders MFA irrelevant on the other.

Pulse 1 — PhantomStealer documents a targeted phishing operation impersonating overseas sales staff, luring victims with quote-confirmation and product-version modification requests. The attachment is a GZ archive containing an injector-type executable that chains multiple UAC bypass techniques — including SSPI-based authentication abuse and CMSTPLUA COM interface elevation — before performing process hollowing to inject the PhantomStealer payload. Tags on the pulse confirm the full capability set: clipboard hijacking (clipper), cryptocurrency wallet theft, BYOVD (bring-your-own-vulnerable-driver) for defense evasion, and credential theft.

Pulse 2 — Mirage2FA exposes an active Phishing-as-a-Service (PhaaS) operation attributed to LinX Coders that has compromised 4,000+ organizations, 63.7% in the United States, spanning Technology, Manufacturing, Education, Finance, Healthcare, and Telecommunications. The kit uses Adversary-in-the-Middle (AitM) proxying over WebSocket channels to steal Microsoft 365 credentials and authenticated session cookies in real time, bypassing TOTP and push-based 2FA. Delivery leverages HTML smuggling to slip landing pages past secure email gateways. Thousands of compromise events were recorded between 2024 and 2026.

The strategic picture: commodity identity theft is now fully industrialized. One crew steals credentials from the endpoint; another steals the authenticated session after MFA succeeds. Enterprises relying on MFA as their control-of-last-resort have a live gap.

Threat Actor / Malware Profile

PhantomStealer (Injector-delivered infostealer)

Distribution: Spearphishing emails impersonating legitimate sales personnel; malicious GZ archive attachment themed as quotation/version confirmation documents
Delivery infrastructure: mail.trimnt.com observed as sender/mail infrastructure
Execution chain: GZ archive → injector EXE → multi-technique UAC bypass (SSPI authentication abuse, CMSTPLUA COM auto-elevation) → process hollowing into a legitimate host process → PhantomStealer payload in memory
Payload behavior: Browser credential harvesting, clipboard hijacking with cryptocurrency address substitution, wallet theft
Anti-analysis / defense evasion: Process hollowing (masquerading as a benign process), BYOVD to terminate EDR/AV drivers, living-off-the-land COM elevation
MITRE mapping: Phishing (T1566), User Execution (T1204), Abuse Elevation Control Mechanism (T1548.002), Process Injection/Hollowing (T1055.012), Masquerading (T1036), Credentials from Password Stores (T1555), Clipboard Data (T1115)

Mirage2FA (LinX Coders PhaaS)

Operator: LinX Coders — selling/leasing the toolkit, consistent with PhaaS economics; downstream affiliates run the lures
Distribution: Phishing emails delivering HTML attachments via HTML smuggling (browser-side assembly of the malicious page, defeating attachment scanning)
Attack chain: Smuggled HTML lure → attacker-controlled AitM proxy impersonating Microsoft 365 login → victim authenticates (including 2FA) → proxy relays session to real Microsoft endpoint and captures the authenticated session cookie → session replay over WebSocket-maintained channel
C2/infrastructure: 75 indicators including IPv4 hosts (192.52.166.55, 209.205.197.130, 181.214.165.173, 83.147.53.130) and domains/hosts (galatasaraydanhaberler.com, sopbtech.store, office.pcvgtech.store, ver.verpox.shop) — note the .store/.shop TLDs with office. and ver. subdomains mimicking Microsoft flows
Impact: Full mailbox, SharePoint, OneDrive, and Teams access; downstream BEC and internal phishing; 4,000+ victims, 63.7% US
MITRE mapping: Phishing (T1566), HTML Smuggling (T1027.006), Adversary-in-the-Middle (T1557), Steal Web Session Cookie (T1539), MFA Bypass via session theft

IOC Analysis

The indicator sets split cleanly by threat type, and SOC teams should treat them differently:

PhantomStealer (file-hash heavy, 12 IOCs):

FileHash-MD5/SHA1/SHA256: 422fe14be9e911b265d6b9852ba4f03bb3245f3dbd8cad10dbd6697a04ff8e4d, 87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff and companion MD5/SHA1 values identify the injector and payload stages. Push SHA256 values to EDR blocklists, email sandbox detonation rules, and software restriction policies. MD5/SHA1 remain useful for retro-hunting in SIEM file-integrity logs.
Hostname: mail.trimnt.com — add to email gateway sender-infrastructure block and hunt received-header logs for historical deliveries.

Mirage2FA (infrastructure heavy, 75 IOCs):

IPv4: 192.52.166.55, 209.205.197.130, 181.214.165.173, 83.147.53.130 — AitM proxy nodes. Block at egress firewall/proxy; alert on any outbound session, as connections indicate a user actively entering credentials into the phishing proxy.
Domains/hostnames: galatasaraydanhaberler.com, sopbtech.store, office.pcvgtech.store, ver.verpox.shop — phishing landing infrastructure. Feed to DNS sinkhole and web proxy categories. The office.* and ver.* subdomain pattern is a reusable detection heuristic.
Tooling: Decode and pivot with the OTX DirectConnect API / OTXv2 Python SDK for automated indicator ingestion, AbuseIPDB/VirusTotal for IP enrichment, urlscan.io for live page capture of phishing domains, and any.run sandbox reports (the referenced source) for behavioral TTPs. Entra ID sign-in logs should be cross-referenced for impossible-travel and token-replay anomalies tied to victim sessions.

Key operational note: file hashes decay fast against repacked injectors; the PhantomStealer behavioral detections (CMSTPLUA elevation, process hollowing) below have far longer shelf life. For Mirage2FA, domain/IP blocking is inherently reactive — session-cookie anomaly detection is the durable control.

Detection Engineering

YAML

---
title: PhantomStealer UAC Bypass via CMSTPLUA COM Interface
description: Detects execution of cmstp.exe with suspicious .inf payloads, a known CMSTPLUA COM auto-elevation technique used by PhantomStealer injector to bypass UAC before process hollowing.
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\cmstp.exe'
    selection_args:
        CommandLine|contains:
            - '.inf'
            - '/s'
            - '/au'
    filter_legit:
        CommandLine|contains:
            - 'C:\Windows\'
            - '%systemroot%'
    condition: selection_img and selection_args and not filter_legit
falsepositives:
    - Legitimate VPN/dial-up profile installations via cmstp
level: high
tags:
    - attack.t1548.002
    - attack.defense_evasion
    - phantomstealer
author: Security Arsenal Threat Intelligence
date: 2026/08/19
---
title: PhantomStealer Process Hollowing - Child Spawned from Suspended or Hollowed Host Process
description: Detects creation of processes in a suspended state followed by memory manipulation, characteristic of PhantomStealer's process hollowing injection, plus hollowed host processes making network connections.
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\rundll32.exe'
            - '\dllhost.exe'
            - '\notepad.exe'
    selection_child:
        CommandLine|contains:
            - 'clipper'
            - '\AppData\Local\Temp\'
            - '.gz'
    selection_user:
        User|contains: 'TEMP'
    condition: selection_parent and (selection_child or selection_user)
falsepositives:
    - Rare; legitimate installers using temp extraction
level: high
tags:
    - attack.t1055.012
    - attack.t1036
    - phantomstealer
author: Security Arsenal Threat Intelligence
date: 2026/08/19
---
title: Mirage2FA AitM Phishing Infrastructure Connection
description: Detects outbound network connections to known Mirage2FA adversary-in-the-middle proxy infrastructure used to harvest Microsoft 365 credentials and session cookies.
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '192.52.166.55'
            - '209.205.197.130'
            - '181.214.165.173'
            - '83.147.53.130'
    selection_domain:
        DestinationHostname|contains:
            - 'galatasaraydanhaberler.com'
            - 'sopbtech.store'
            - 'pcvgtech.store'
            - 'verpox.shop'
    condition: 1 of selection_*
falsepositives:
    - None expected; these are dedicated phishing nodes
level: critical
tags:
    - attack.t1557
    - attack.t1539
    - attack.t1566
    - mirage2fa
author: Security Arsenal Threat Intelligence
date: 2026/08/19

KQL — Microsoft Sentinel / Defender

// Mirage2FA + PhantomStealer unified hunt — Microsoft Sentinel
// 1) Network hits against Mirage2FA AitM infrastructure
let Mirage2FA_IPs = dynamic(["192.52.166.55","209.205.197.130","181.214.165.173","83.147.53.130"]);
let Mirage2FA_Domains = dynamic(["galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in~ (Mirage2FA_IPs)
   or RemoteUrl has_any (Mirage2FA_Domains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemoteUrl, ActionType;
// 2) PhantomStealer behaviors: CMSTPLUA UAC bypass + temp-folder injector execution + GZ phishing attachment staging
let ProcHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (FileName =~ "cmstp.exe" and ProcessCommandLine has_any (".inf","/au"))
   or (FileName =~ "powershell.exe" and ProcessCommandLine has "FromBase64String" and ProcessCommandLine has "temp")
   or (FolderPath has_any ("\\AppData\\Local\\Temp\\","\\Downloads\\") and ProcessCommandLine has ".gz")
   or (FileName =~ "cmstp.exe" and InitiatingProcessFileName !in~ ("explorer.exe","msiexec.exe"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
// 3) Correlate: any device with BOTH network and process hits is a probable active compromise
union NetHits, ProcHits
| summarize EventCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName
| order by LastSeen desc;

PowerShell

# Security Arsenal — PhantomStealer & Mirage2FA IOC Hunt Script
# Run elevated on suspected endpoints; outputs findings to console + CSV
$report = @()

Write-Host "[*] Checking for PhantomStealer CMSTPLUA UAC bypass artifacts..." -ForegroundColor Cyan
# Prefetch evidence of cmstp abuse
$cmsHits = Get-ChildItem "$env:SystemRoot\Prefetch" -Filter "CMSTP.EXE-*.pf" -ErrorAction SilentlyContinue
if ($cmsHits) { $report += [PSCustomObject]@{Type="UAC-Bypass"; Artifact="CMSTP prefetch: $($cmsHits.Name -join ', ')"; Risk="High"} }

# PhantomStealer file-hash sweep (SHA256) in common staging dirs
$hashes = @("422fe14be9e911b265d6b9852ba4f03bb3245f3dbd8cad10dbd6697a04ff8e4d",
            "87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff")
Write-Host "[*] Hash-sweeping Temp/Downloads for PhantomStealer payloads..." -ForegroundColor Cyan
foreach ($dir in @("$env:TEMP","$env:USERPROFILE\Downloads","$env:LOCALAPPDATA\Temp")) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hashes -contains $h) { $report += [PSCustomObject]@{Type="Malware-File"; Artifact="$($_.FullName) [$h]"; Risk="Critical"} }
    }
}

Write-Host "[*] Checking live connections to Mirage2FA AitM infrastructure..." -ForegroundColor Cyan
$badIPs = @("192.52.166.55","209.205.197.130","181.214.165.173","83.147.53.130")
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $badIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $report += [PSCustomObject]@{Type="AitM-C2-Connection"; Artifact="$($c.RemoteAddress):$($c.RemotePort) via $proc (PID $($c.OwningProcess))"; Risk="Critical"}
}

Write-Host "[*] Checking DNS cache for Mirage2FA phishing domains..." -ForegroundColor Cyan
$badDomains = @("galatasaraydanhaberler","sopbtech","pcvgtech","verpox")
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $n=$_.Name; $badDomains | Where-Object { $n -like "*$_*" } } | ForEach-Object {
    $report += [PSCustomObject]@{Type="Phish-DNS"; Artifact="$($_.Name) -> $($_.Data)"; Risk="High"}
}

Write-Host "[*] Checking clipboard-monitor persistence (PhantomStealer clipper)..." -ForegroundColor Cyan
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
    Get-ItemProperty $rk -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty $rk -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
        if ($val -match "Temp|AppData.{0,30}\.exe") { $report += [PSCustomObject]@{Type="Persistence"; Artifact="$rk\$($_.Name) = $val"; Risk="High"} }
    }
}

if ($report.Count -gt 0) { $report | Format-Table -AutoSize; $report | Export-Csv ".\iocs_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation }
else { Write-Host "[+] No IOC artifacts found." -ForegroundColor Green }

Response Priorities

Immediate (0–4 hours):

Block all Mirage2FA IPs/domains at egress firewall, web proxy, and DNS; block mail.trimnt.com at the email gateway and purge queued mail from that sender infrastructure
Push PhantomStealer SHA256 hashes to EDR blocklists; enable the Sigma detections above in the SIEM
Any device with a Mirage2FA connection hit: treat the associated user as actively phished — pull the session and force re-authentication immediately

24 Hours (identity containment):

For every user matching Mirage2FA infrastructure contact: revoke all Entra ID refresh tokens and active sessions (Revoke-MgUserSignInSession), force password reset, and re-register MFA. Blocking alone is insufficient — stolen session cookies remain valid until revoked
Audit Entra ID sign-in logs for affected users: impossible travel, anomalous ASN/user-agent on OfficeHome/Office365 resource access, and inbox-rule creation (BEC staging)
Run the PowerShell hunt script fleet-wide via your RMM/EDR; isolate endpoints with PhantomStealer hash or CMSTPLUA hits and image rather than clean (BYOVD + hollowing = low confidence in remediation)
Retro-hunt 14+ days of proxy/DNS logs — Mirage2FA has operated since 2024 and these IOCs are current snapshots only

1 Week (architecture hardening):

This is the structural fix: Mirage2FA's entire model is defeated by phishing-resistant MFA. Migrate high-risk users (Finance, IT admins, executives) to FIDO2 passkeys or certificate-based auth, and enforce Conditional Access token protection / continuous access evaluation (CAE) so stolen session cookies can't be replayed from foreign infrastructure
Block GZ/ISO/IMG archives at the email gateway; force detonation; alert on HTML attachments (HTML smuggling vector) or rewrite them
Implement application allow-listing rules blocking cmstp.exe child processes and unsigned executables in %TEMP%/%APPDATA%
Subscribe to the OTX pulses referenced here via DirectConnect for automated IOC feed ingestion into your SIEM and firewall blocklists

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

PhantomStealer Injector + Mirage2FA AitM PhaaS: OTX Pulse Analysis — Credential Theft Detection Pack