PhantomVAI Custom Loader Abuses RunPE Utility to Launch Stealthy Attacks on Users

Gbhackers •Mayura Kathir • February 4, 2026

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PhantomVAI Loader Exploits RunPE Utility in Global Phishing Campaigns The PhantomVAI custom loader has been identified in phishing campaigns, delivering stealers and remote access trojans (RATs) to compromised systems. This malware disguises itself as legitimate software and utilizes process hollowing techniques to inject malicious payloads into Windows processes. Multiple security researchers have documented this threat across various organizations. 2 sources 39

Extracted Entities

PhantomVAI Custom Loader Abuses RunPE Utility to Launch Stealthy Attacks on Users

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)