SysPhon, also called WAVESHAPER, is a host-profiling payload used by BlueNoroff in the GhostCall campaign and a later axios-themed operation. It collects information needed to identify valuable victims and, when selection criteria are met, retrieves additional payloads. Windows infection chains used VBS and PowerShell scripts to deploy subsequent stages. Operators replaced the Windows SysPhon payload during an attack, possibly to avoid profiling the same host twice, reflecting active management of a multi-stage, victim-selection workflow.