PhantomPolia Campaign Uses ClickFix and Donut Shellcode to Deliver Remus Stealer

Oct 7, 2026 · Original article ↗

Summary

LevelBlue details a campaign that uses compromised sites, a blockchain-based loader and ClickFix lures to deliver Remus Stealer, which collects credentials, browser and wallet data, and system information.

Key points

LevelBlue observed multiple ClickFix lure sites since early September 2026, linked to compromised websites embedding the PhantomPolia JavaScript loader.
PhantomPolia retrieves encrypted configuration from Ethereum Sepolia smart contracts via public RPC endpoints, decrypts it, and uses the resulting domain to load the next-stage script.
The ClickFix lure prompts victims to run a hidden PowerShell command, which retrieves and decrypts additional stages before downloading an installer bundled with AutoIt.
The AutoIt script decrypts Donut-packed shellcode and executes it from dynamically allocated memory, ultimately loading Remus Stealer.
Remus Stealer targets credentials, browser data, password managers, cryptocurrency wallets, and system information, and can capture the desktop.
The malware compresses collected data with a custom LZ77 method, encrypts it with ChaCha20, and sends it to attacker-controlled infrastructure.
The article includes campaign indicators and Suricata and EDR hunting rules covering the loader, ClickFix activity, PowerShell, AutoIt, and Remus communications.

Article Details

Attack Vectors: Compromised websites embed the PhantomPolia JavaScript loader, which retrieves encrypted configuration from Ethereum Sepolia and resolves the next-stage domain.
A ClickFix lure prompts victims to run a hidden PowerShell command that downloads and decrypts further stages.
The delivery chain downloads an installer bundled with AutoIt3.exe and an AutoIt script; the script decrypts and executes Donut-packed shellcode in memory, loading Remus Stealer.
Remus Stealer collects system, browser, credential, password-manager, wallet, and screen-capture data, then encrypts and sends it to attacker-controlled infrastructure.
Defensive Notes: Hunt for hidden PowerShell execution using execution-policy bypass, Invoke-Expression, and Invoke-WebRequest, including requests for /check/update.ps1.
Monitor unexpected connections to the Sepolia RPC endpoints and requests matching the article’s PhantomPolia staging and visitor-registration paths.
Detect AutoIt3.exe launched with randomized Setup_, AutoStart_, or Config_ .au3 scripts, and investigate executable-memory allocation followed by thread execution.
Monitor Remus-style HTTP POST registration, token-assignment, and multipart data-upload traffic, as well as unexpected outbound traffic to the listed C2 domains.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`cruahop[.]shop`	Domain listed as Remus Stealer C2 infrastructure.
DOMAIN	`drepace[.]click`	Domain listed as Remus Stealer C2 infrastructure.
DOMAIN	`ironphantomcore[.]top`	Domain identified as a PhantomPolia C2 domain.
DOMAIN	`nightflamevortex[.]top`	Domain identified as a PhantomPolia C2 domain.
DOMAIN	`oceanvw[.]click`	Domain listed with Remus Stealer C2 indicators.
DOMAIN	`shadowemberstrike[.]top`	Domain identified as a PhantomPolia C2 domain.
DOMAIN	`spogear[.]click`	Remus Stealer C2 domain; the article reports the malware communicating with it on port 3546.
DOMAIN	`stormvenomforge[.]top`	Domain identified as a PhantomPolia C2 domain.
DOMAIN	`velnoderic[.]com`	Domain decrypted from PhantomPolia configuration and used to construct the next-stage payload URL.
DOMAIN	`voderlence[.]com`	Domain identified as a PhantomPolia C2 domain.
DOMAIN	`voidravenstorm[.]top`	Domain identified as a PhantomPolia C2 domain.
SHA256	`05629f35dfe1409ea963c135581c228e3b71869b0707974244f6938af635a70e`	Hash listed as a campaign artifact in the IOC appendix.
SHA256	`22b0fc350b5e5c557344267b3c44323ac117d3fbeb5cf1bcb8b027352155fa11`	Hash listed as a campaign artifact in the IOC appendix.
SHA256	`5363bc92bac44aa2ba87b46c59fd3f78d5cdd32839efa854e97380a55fdacabb`	Hash listed for the Donut shellcode artifact.
SHA256	`61def8b242913b520ec110458a416b02a6a38dc8765bc76bd571ee7ae8350aae`	Hash listed as a campaign artifact in the IOC appendix.
SHA256	`8f4903b8b110ec1b9580a5a27bf49c3e4793538a863100559d085b7545fcda25`	Hash listed as a campaign artifact in the IOC appendix.
SHA256	`a0923188fbd52277e1711ae312f3c6fb841f3cdebe1a95d5c89fe2455f8ace32`	Hash listed as a campaign artifact in the IOC appendix.
SHA256	`a38e6f54efe342b4a2ca9ac4428a5268faed96cd602baa1886efb09f72435abb`	Hash listed as a campaign artifact in the IOC appendix.
SHA256	`dc0a864f441f0237853b40217eda577defb7c1dd15af407c7241688b1b3a3b46`	Hash listed for the Remus Stealer artifact.
SHA256	`f02e2fefd74c7268e3aced61017173fff92e2a1d0e7eaf7807189f371fbfcc1f`	Hash listed as a campaign artifact in the IOC appendix.
URL	`hxxps[:]//cloudcheckic[.]com/3956c8bdebb48342cb2e265b6be19ae4?id=11a879d4599de275ab48f899bb6c507cb80559204178c1854de131c5cc7af65f&nonce=eb82ad83d725e7f703d0bdc7b2927f8d&ts=1789650643328`	Observed attacker-server URL used to retrieve key material for decrypting the next stage.
URL	`hxxps[:]//cloudcheckic[.]com/a698891e68d71ead7b51649ec27a1384?id=cf1d026f09e207c1ea44e5e0cb272ee272ab8f96507959dd0b20e0542c666f0f&nonce=c5999babb6d361afb4a799f3fb9f4f00&ts=1789650568000`	Observed attacker-server URL used to retrieve the next PowerShell stage.
URL	`hxxps[:]//cloudcheckic[.]com/f654a79f56219371b242f551552191a7`	Payload-download URL used by the decrypted PowerShell stage.