+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Malware and Viruses (https://hackforums.net/forumdisplay.php?fid=287)
+---- Thread: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) (/showthread.php?tid=6315458)
Pages: Pages
1
2
[RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - 1rhino2 - Dec 9, 2025
PHANTOM STEALER
Open Source Golang Infostealer - Full Source Code
What is this?
Full source code for a Windows infostealer written in Go. Grabs browser passwords, cookies, crypto wallets, Discord tokens, and more. Sends everything to Discord webhook or Telegram bot.
Built this as a learning project, figured I'd release it for anyone who wants to learn or use it for research.
Features:
Browser Stealer - Chrome, Edge, Brave, Opera, Firefox + more
- Passwords (DPAPI + AES-GCM decryption)
- Cookies
- Credit cards
- Autofill
- History
Crypto Wallet Stealer - 40+ wallets
- Desktop: Exodus, Electrum, Atomic, Bitcoin Core, etc
- Extensions: MetaMask, Phantom, Trust, Coinbase, Ronin, etc
Token Grabber
- Discord tokens (including encrypted)
- Telegram sessions (tdata)
- Steam (SSFN + config)
System Info
- Screenshot
- Clipboard
- WiFi passwords
- Hardware specs
- Installed software
- Running processes
Evasion
- VM detection
- Debugger detection
- AMSI/ETW patching
- Defender exclusion
Persistence (optional)
- Registry
- Startup folder
- Scheduled task
- WMI subscription
Exfil
- Discord webhook
- Telegram bot
- Zipped and organized
Setup:
1. Edit config/config.go with your webhook/bot token
2. Build: go build -ldflags "-s -w -H windowsgui" -o stub.exe .
3. Optional: Use garble for obfuscation
4. Run and check your webhook
Download:
github. com/1rhino2/phantom-stealer
Scans:
Clean build: ~5-10/70 on VT (expected for any stealer)
With garble: lower detection
Credits:
Solo project, built from scratch. No copy paste.
Note:
For educational purposes. Don't be stupid with it.
Questions? Reply below or check the GitHub issues.
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - gerg61 - Dec 9, 2025
works with latest chrome ver?
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - 1rhino2 - Dec 9, 2025
(Dec 9, 2025 10:58 AM)gerg61 Wrote: works with latest chrome ver?
Indeed.
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - i am - Dec 10, 2025
Very impressive contribution. Skeptic in me imagines it's backdoored but I'll take a look. Thank you.
Haven't found any backdoors. Document fetch works well but can confirm it didn't get any of my test browser passwords.
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - sp3cifier - Dec 11, 2025
i will test it out
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - 1rhino2 - Dec 11, 2025
(Dec 10, 2025 06:28 AM)i am Wrote: Very impressive contribution. Skeptic in me imagines it's backdoored but I'll take a look. Thank you.
Haven't found any backdoors. Document fetch works well but can confirm it didn't get any of my test browser passwords.
Sorry to hear, i'll work on fixing that. I haven't worked much with browsers so its my first time, I did some backup research, thought it would work.
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - randomssa - Dec 11, 2025
Bro I aint gonna lie ts highly detected even defender killed it on the spot for me. I reccomend scanning it in tip.neiki.dev for testing the payload against a bunch of common scanners/vms
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - 1rhino2 - Dec 11, 2025
(Dec 9, 2025 02:50 AM)1rhino2 Wrote: PHANTOM STEALER
Open Source Golang Infostealer - Full Source Code
What is this?
Full source code for a Windows infostealer written in Go. Grabs browser passwords, cookies, crypto wallets, Discord tokens, and more. Sends everything to Discord webhook or Telegram bot.
Built this as a learning project, figured I'd release it for anyone who wants to learn or use it for research.
Features:
Browser Stealer - Chrome, Edge, Brave, Opera, Firefox + more
- Passwords (DPAPI + AES-GCM decryption)
- Cookies
- Credit cards
- Autofill
- History
Crypto Wallet Stealer - 40+ wallets
- Desktop: Exodus, Electrum, Atomic, Bitcoin Core, etc
- Extensions: MetaMask, Phantom, Trust, Coinbase, Ronin, etc
Token Grabber
- Discord tokens (including encrypted)
- Telegram sessions (tdata)
- Steam (SSFN + config)
System Info
- Screenshot
- Clipboard
- WiFi passwords
- Hardware specs
- Installed software
- Running processes
Evasion
- VM detection
- Debugger detection
- AMSI/ETW patching
- Defender exclusion
Persistence (optional)
- Registry
- Startup folder
- Scheduled task
- WMI subscription
Exfil
- Discord webhook
- Telegram bot
- Zipped and organized
Setup:
1. Edit config/config.go with your webhook/bot token
2. Build: go build -ldflags "-s -w -H windowsgui" -o stub.exe .
3. Optional: Use garble for obfuscation
4. Run and check your webhook
Download:
github. com/1rhino2/phantom-stealer
Scans:
Clean build: ~5-10/70 on VT (expected for any stealer)
With garble: lower detection
Credits:
Solo project, built from scratch. No copy paste.
Note:
For educational purposes. Don't be stupid with it.
Questions? Reply below or check the GitHub issues.
Fixing the issue
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - wiener222213 - Dec 12, 2025
Ai Generated
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - ByteDoktor - Dec 12, 2025
(Dec 12, 2025 02:54 AM)wiener222213 Wrote: Ai Generated
The code does appear to be that with the amount of comments but i could be wrong and it's still a good educational tool.
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - SIM-5420628 - Dec 23, 2025
(Dec 11, 2025 05:42 AM)randomssa Wrote: Bro I aint gonna lie ts highly detected even defender killed it on the spot for me. I reccomend scanning it in tip.neiki.dev for testing the payload against a bunch of common scanners/vms
I mean you shouldnt expect a free stealer to be ud
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - kingCode - Dec 24, 2025
Very Nice
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - sigmaboss2 - Jan 5, 2026
hello your miner very bad work, users not found in pool. 500 hashrate for 10 computer xd
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - SIM-5730195 - Jan 7, 2026
this does NOT work on the latest chrome version
RE: [RELEASE] Phantom Stealer - Open Source Golang Infostealer (Browser/Crypto/Discord) - ShellPower - Jan 14, 2026
(Dec 9, 2025 01:34 PM)1rhino2 Wrote: Indeed.
Have you managed to try it out yet?
would like to hear some objective opinion