A multi-stage malware delivery chain initiated by a VBScript dropper that fetches and executes a .NET binary obfuscated with ConfuserEx. The payload, identified as Phantom Stealer, employs layered evasion tactics including base64 encoding, reflective loading, and anti-analysis techniques. The article covers static and dynamic analysis of the VBScript, reverse engineering of the obfuscated .NET executable, and telemetry.