PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems

Gbhackers •Mayura Kathir • June 2, 2026

New technical details PHANTOMPULSE, a sophisticated remote access trojan (RAT) used in multi-stage intrusions targeting Windows environments. The malware represents the final payload in an attack chain previously linked to Obsidian plugin abuse and in-memory loaders, but this latest analysis focuses on its advanced post-exploitation capabilities. PHANTOMPULSE stands out for combining multiple stealth techniques, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHANTOMPULSE RAT Targets Windows Systems with UAC Bypass and Process Injection The PHANTOMPULSE remote access trojan (RAT) has emerged as a significant threat, leveraging UAC bypass and process injection techniques to compromise Windows systems. It is the final payload in a multi-stage attack chain known as REF6598, primarily targeting the cryptocurrency sector. This malware showcases advanced post-exploitation capabilities, making it particularly dangerous for organizations in this space. The attack is characterized by its stealth techniques, which help it evade detection. Security professionals are urged to remain vigilant as the threat landscape evolves. Current mitigation strategies are still being developed as the malware is actively analyzed. 2 sources 65

Extracted Entities

PHANTOMPULSE RAT Uses UAC Bypass to Hijack Windows Systems

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)