diff --git a/data/yara/CAPE/PhantomStealer.yar b/data/yara/CAPE/PhantomStealer.yar
new file mode 100644
index 00000000000..3c2dbdba54c
--- /dev/null
+++ b/data/yara/CAPE/PhantomStealer.yar
@@ -0,0 +1,13 @@
+rule PhantomStealer
+{
+    meta:
+        author = "kevoreilly"
+        description = "PhantomStealer Payload"
+        cape_type = "PhantomStealer Payload"
+    strings:
+        $a1 = "PhantomStealer"
+        $a2 = "FormatCreditCards"
+        $a3 = "Telegram"
+    condition:
+        uint16(0) == 0x5A4D and (all of ($a*))
+}