That RFQ email from a trusted supplier? It might be delivering Phantom Stealer — a toolkit built to harvest your credentials at scale.

Group-IB researchers have identified a sustained phishing campaign targeting European logistics, manufacturing, and tech companies. Across five distinct waves over three months, every email was blocked by Group-IB's Business Email Protection before reaching end users.

The emails mimic legitimate procurement correspondence with professional signatures and spoofed sender identities. But inside the archive attachment is an infostealer that harvests browser credentials, session tokens, and payment data.

Phantom Stealer is part of a growing stealer-as-a-service market - credential theft is now a subscription business, and threats like this are only scaling.

Our latest Email Protection Spotlight breaks down the full campaign and shows how multi-layer detection stopped it at the inbox. Read the full analysis.

#CyberSecurity #Phishing #InfoStealer #EmailProtection