New Malware Attack Using Variable Functions and Cookies to Evade and Hide Their Malicious Scripts

A sophisticated malware campaign has been detected targeting WordPress sites using PHP variable functions and cookie-based obfuscation. The malware fragments code across cookies, reconstructing executable functions at runtime, enabling stealth execution and persistent backdoor control across 30,000+ infections.

New Malware Uses PHP Variable Functions and Cookies to Evade Detection

PhantomVAI Loader Delivers a Range of Infostealers

Unit 42 researchers uncovered a global phishing campaign deploying PhantomVAI Loader to deliver multiple infostealers, including AsyncRAT, XWorm, and FormBook. The malware leverages steganography, obfuscated scripts, and PowerShell loaders to evade detection. This evolution from Katz Stealer marks an escalation in malware-as-a-service sophistication targeting education, manufacturing, and government sectors.

📂 Malware

New Malware Uses PHP Variable Functions and Cookies to Evade Detection

PhantomVAI Loader Delivers Infostealers via Phishing Campaigns