Skip to content
Threat Feed
Subscribe

Actor

Phantom Stealer

1 brief RSS
medium threat

Detection of Unauthorized WinSCP Credential Access

This analytic detects unauthorized access to the WinSCP security configuration folder, which stores sensitive SSH and FTP credentials, by processes other than WinSCP, leveraging Windows Security Event 4663 to identify abnormal read or access attempts often indicative of credential-stealing malware like Phantom Stealer.

WinSCP Phantom Stealer credential-theft infostealer windows
1r 1t 2i