SOCRadar tracks ClickFix campaign targeting three continents

SOCRadar’s Threat Research Unit (STRU) reports a Russian-speaking threat group has updated and scaled a multi-stage phishing operation that leverages an AI-assisted toolkit. The campaign chains XaocMail, a self-hosted phishing platform delivering ClickFix-style lures, with Phantom53, a DNS-over-HTTPS (DoH) command-and-control framework, and Havoc (HavoX) as the post-exploitation payload.

According to STRU, the infrastructure relies on legitimate services—Cloudflare Workers and public DoH resolvers—to blend traffic with normal network activity and improve resilience via a week-keyed SHA256 DGA for domain failover.

The operation’s delivery chain begins with XaocMail creating personalised phishing templates and ClickFix landing pages that host MSI, PowerShell, or HTA payloads. Victims are directed to Cloudflare Worker pages that deliver the MSI or other injects, with the final payload executing Phantom53. Phantom53 uses DoH to poll for commands, exfiltrate telemetry, and load Havoc Demon code on demand via a watcher component.

The beacon, watcher and Havoc Demon are orchestrated in isolated Python environments, with scheduled tasks and UAC/escalation logic designed to evade user prompts and sandboxing. STRU notes an on‑premises admin interface (adminka) for operators to manage bots, domains and payload aliases, and a DoH handshake and 16‑byte IPv6 payloads encode commands.

Targeting covers Latin America, Asia and Europe—particularly Brazil, Peru, India, Indonesia, and Spain—with English and Spanish/Portuguese being common languages. The report highlights extensive use of AI tooling (Claude Code) in development and testing, and notes a broad range of sectors including technology, finance, education, government, logistics and manufacturing.