TokenPhantom is a Kimsuky-linked cryptocurrency campaign operated through a convincing fake trading platform called Tralert FX in early 2026. The operators distributed a trojanized Electron desktop application through direct downloads and the Microsoft Store, fingerprinted visitors, collected host and security-product information, and exfiltrated data through GitLab and an HTTP backend. Execution was restricted with IP and MAC allowlists, after which an in-memory loader repaired a deliberately corrupted GZIP payload and loaded a customized Xeno RAT build associated with the MoonPeak toolset. The campaign was linked specifically to the UAT-5394 sub-cluster.