Skip to content
ThreatCluster

PHANTOMPULSE RAT Targets Windows Systems with UAC Bypass and Process Injection

First seen 2 Jun 2026, 09:23 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •June 3, 2026 at 08:52 UTC
  • •PHANTOMPULSE RAT uses UAC bypass and process injection to compromise Windows systems.
  • •It is linked to a broader attack chain known as REF6598, targeting the cryptocurrency sector.
  • •The malware employs advanced stealth techniques, raising concerns among cybersecurity professionals.

The PHANTOMPULSE remote access trojan (RAT) has emerged as a significant threat, leveraging UAC bypass and process injection techniques to compromise Windows systems. It is the final payload in a multi-stage attack chain known as REF6598, primarily targeting the cryptocurrency sector. This malware showcases advanced post-exploitation capabilities, making it particularly dangerous for organizations in this space. The attack is characterized by its stealth techniques, which help it evade detection. Security professionals are urged to remain vigilant as the threat landscape evolves. Current mitigation strategies are still being developed as the malware is actively analyzed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 145d ago How this analysis works

Timeline

2026-06-02
PHANTOMPULSE RAT identified
Security researchers disclosed the PHANTOMPULSE RAT, highlighting its advanced capabilities and targeting methods.
Gbhackers
2026-06-02
Attack chain REF6598 linked to PHANTOMPULSE
The malware was identified as the final payload in a multi-stage attack chain targeting cryptocurrency systems.
Cybersecuritynews

More articles in this cluster (2)

Following this threat?

Track Phantompulse in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4