PhantomVAI Custom Loader Uses RunPE Utility to Attack Users

Cybersecuritynews •Tushar Subhra Dutta • February 4, 2026

A sophisticated custom loader named PhantomVAI has emerged in global phishing campaigns, delivering various stealers and remote access trojans (RATs) to compromised systems. This malware loader operates by masquerading as legitimate software and employing process hollowing techniques to inject malicious payloads into Windows processes. Security researchers across multiple organizations have documented this threat under different […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PhantomVAI Loader Exploits RunPE Utility in Global Phishing Campaigns The PhantomVAI custom loader has been identified in phishing campaigns, delivering stealers and remote access trojans (RATs) to compromised systems. This malware disguises itself as legitimate software and utilizes process hollowing techniques to inject malicious payloads into Windows processes. Multiple security researchers have documented this threat across various organizations. 2 sources 39

Extracted Entities

PhantomVAI Custom Loader Uses RunPE Utility to Attack Users

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)