Fantom is a trojan-like ransomware on Microsoft Windows that masquerades as a critical Windows Update. However, should the user install this "update", Fantom will encrypt the user's files.

When the program is executed, the ransomware will extract and execute another embedded program called "WindowsUpdate.exe". This 'Windows Update' puts a fake windows updating screen that overlays all of the active Windows and does not allow the user to switch to any other open applications.