Operation MoneyMount-ISO Phantom Stealer phishing campaign targeting Russian finance entities
Campaign
Summary
Hide ▲
Show ▼
The Operation MoneyMount-ISO phishing campaign is actively targeting organizations in Russia, and it matters because the emails deliver Phantom Stealer through malicious ISO optical disc images. The main targets are finance and accounting entities, with procurement, legal, and payroll groups also in scope. The lure uses a fake bank transfer confirmation and a ZIP-to-ISO attachment chain to launch the stealer. The malware can steal wallet, browser, and credential data and exfiltrate it through Telegram, Discord, or FTP.
Related Happenings
SideCopy Operation XENOFISCAL spear-phishing campaign targeting Afghan finance entities
Campaign
H score25
First: 02.06.2026 12:05
Last: 02.06.2026 12:05
Sources 1
About this happening:
The **SideCopy**-linked **Operation XENOFISCAL** spear-phishing campaign is targeting **Afghanistan's Ministry of Finance** and related provincial finance offices with **Xeno RAT*...
SideCopy Operation XENOFISCAL spear-phishing campaign targeting Afghan finance entities
CampaignAbout this happening: The **SideCopy**-linked **Operation XENOFISCAL** spear-phishing campaign is targeting **Afghanistan's Ministry of Finance** and related provincial finance offices with **Xeno RAT*...
Operation Dragon Weave cyber-espionage campaign
Campaign
H score37
First: 01.06.2026 14:54
Last: 01.06.2026 14:54
Sources 1
About this happening:
The **Operation Dragon Weave** campaign is actively targeting **officials and citizens in the Czech Republic and Taiwan** with **spear-phishing ZIP attachments**. The infection ch...
Operation Dragon Weave cyber-espionage campaign
CampaignAbout this happening: The **Operation Dragon Weave** campaign is actively targeting **officials and citizens in the Czech Republic and Taiwan** with **spear-phishing ZIP attachments**. The infection ch...
Phantom Stealer phishing delivery and exfiltration activity
Malware Activity
H score30
First: 15.12.2025 18:00
Last: 15.12.2025 18:00
Sources 1
About this happening:
**Phantom Stealer** is being delivered through a **phishing campaign** that uses a **ZIP-to-ISO attachment chain** to bypass mail defenses, exposing **Russian-speaking organizatio...
Phantom Stealer phishing delivery and exfiltration activity
Malware ActivityAbout this happening: **Phantom Stealer** is being delivered through a **phishing campaign** that uses a **ZIP-to-ISO attachment chain** to bypass mail defenses, exposing **Russian-speaking organizatio...
Ukrainian government impersonation SVG phishing campaign
Campaign
H score37
First: 26.09.2025 19:40
Last: 26.09.2025 19:40
Sources 1
About this happening:
A **phishing campaign** impersonating **Ukrainian government agencies** is delivering **CountLoader**, raising the risk of **stealer** and **cryptominer** infections for targeted...
Ukrainian government impersonation SVG phishing campaign
CampaignAbout this happening: A **phishing campaign** impersonating **Ukrainian government agencies** is delivering **CountLoader**, raising the risk of **stealer** and **cryptominer** infections for targeted...
Timeline
-
15.12.2025 11:24 2 articles · 6mo ago
Operation MoneyMount-ISO phishing campaign disclosure
Initial DisclosureResearchers disclosed Operation MoneyMount-ISO, an active phishing campaign targeting finance and accounting entities in Russia, with procurement, legal, and payroll groups also in scope. The emails use a fake bank transfer confirmation lure and a ZIP-to-ISO attachment chain that mounts a malicious ISO image and launches Phantom Stealer through an embedded DLL, enabling theft of wallet-extension data, browser passwords, cookies, credit card details, Discord tokens, clipboard content, and keystrokes, with exfiltration via Telegram, Discord, or FTP.
Show sources
- Phantom Stealer Spread by ISO Phishing Emails Hitting Russian Finance Sector — thehackernews.com — 15.12.2025 11:24
- Phantom Stealer Spread by ISO Phishing Emails Hitting Russian Finance Sector — thehackernews.com — 15.12.2025 11:24