AhnLab reported a real phishing email campaign that pretends to be a sales representative asking the victim to review and revise a quote and verify product versions. The email includes a malicious compressed attachment that leads to an executable which ultimately installs PhantomStealer, an information-stealing malware.
This campaign, reported by AhnLab ASEC, used a business-like pretext to get a foothold on victim machines. The sender impersonated a sales team member at an overseas company and claimed that a previous quote needed to be revised, asking the recipient to verify product versions and review an attached quote. This kind of request fits naturally into procurement, finance, and sales workflows, which is likely why those roles are called out as primary targets.
The email carried a compressed attachment named 7200_Quantum_Enterprise_LLC_SSO-0661.GZ. Inside was an executable, 7200_Quantum_Enterprise_LLC_SSO-0661.Exe. If a recipient extracted and ran that file, it functioned as an injector: it attempted to disable security tools and then ran PhantomStealer inside a legitimate Windows process, making detection harder.
The pretext works because it mirrors routine business correspondence. A request to double-check a quote or verify product versions is mundane enough that recipients in procurement, finance, and sales may not pause before opening the attachment. There is no obvious urgency or threat in the language, which lowers suspicion compared to more aggressive phishing lures.
The attack also relies on a compressed file format to bypass some email security filtering, since scanners may not always unpack and inspect nested executables the same way they inspect direct attachments.
Once running, PhantomStealer is built to harvest a wide range of sensitive data, including:
This breadth means a single successful click can expose stored passwords, active sessions, and financial assets, not just a single account.
Organizations should treat unsolicited quote or invoice emails with attachments as high-risk, even when they look like ordinary business correspondence. Employees handling procurement, finance, and sales communications should be trained to avoid opening compressed attachments from unfamiliar senders and to never run executables received by email. If an attachment has already been opened, reporting it immediately gives security teams the best chance to limit exposure of credentials, session cookies, and wallet data before they are exfiltrated. This maps to techniques such as T1566.001 and T1204.002.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a phishing email campaign that impersonates a sales team member asking a recipient to review and revise a quote and verify product versions, using a compressed attachment that leads to an executable installing PhantomStealer malware.
According to the report, it collects keystrokes, screenshots, stored browser and application credentials, login session cookies, system and network information, and cryptocurrency wallet and clipboard data.
The email contains a compressed file named 7200_Quantum_Enterprise_LLC_SSO-0661.GZ, which contains an executable that acts as an injector, attempting to disable security tools before running PhantomStealer inside a legitimate Windows process.
The report's guidance is to report it immediately, since the attack is designed to steal sensitive information such as passwords, cookies, and wallet data.
You get an email: “Please review the attached quote revision and verify the product versions.” Looks totally routine, right? But that .GZ file hides an EXE: 7200_Quantum_Enterprise_LLC_SSO-0661.Exe. Open it, and PhantomStealer quietly injects into Windows, turns off protection, and starts grabbing keystrokes, screenshots, saved passwords, cookies, even crypto wallet data. Here’s the tell: a random overseas “sales rep” sends an unsolicited quote revision, and the only way to review it is a compressed .GZ file that turns into an EXE. Real vendors send quotes as PDFs or through your usual portal, not as runnable programs. Your move: if an email quote or invoice comes with a compressed file or anything that turns into an EXE, don’t open it, report it to Security immediately.
Researchers observed real phishing emails posing as transaction receipts to trick people into opening a PDF attachment. The PDF claims an “Adobe Flash Player update is required,” leading victims to download and run a script that silently installs ScreenConnect for persistent remote access.
Researchers report real-world attacks in Korea where victims are tricked into opening shortcut (LNK) files or “security software” installers that secretly install the Xctdoor backdoor. The lures use believable filenames (e.g., account statements, lease documents, resumes) and fake installers (e.g.,…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
Researchers reported a real campaign by the China-based Silver Fox group against a Japanese industrial manufacturer. The attack starts with an invoice-themed phishing message that leads victims to open a ZIP file, triggering a DLL sideloading chain and installing ValleyRAT for persistent remote…
AhnLab reports real-world spear-phishing attacks by the Kimsuky group that impersonate diplomatic personnel and trick targets into opening disguised LNK “document” attachments. Opening the fake document launches scripts that install tools like the PebbleDash backdoor and PrxClient proxy, enabling…
