Executive Summary
The SOCRadar Threat Research Unit has identified an advanced campaign by a Russian-speaking threat actor utilizing an AI-assisted toolkit to target entities across Latin America, Asia, and Europe. Active since at least August 2026, the operation leverages the XaocMail phishing platform to deliver 'ClickFix' document-sharing lures. These lures deceive victims into executing malicious commands that deploy Phantom53, a stealthy Command and Control (C2) framework.
Phantom53 distinguishes itself through a multi-stage execution chain hosted within Python virtual environments and a C2 protocol that leverages DNS-over-HTTPS (DoH) to blend with legitimate traffic. The campaign is highly resilient, featuring a weekly Domain Generation Algorithm (DGA) for failover and utilizing serverless infrastructure like Cloudflare Workers. For high-value targets, the actor deploys the Havoc (HavoX) post-exploitation framework to perform extensive credential theft and data exfiltration.
This threat is significant due to its use of Anthropic’s Claude Code for development automation and its targeting of critical sectors, including technology, finance, and government. The actor's ability to blend malicious traffic with trusted providers like Google and Cloudflare necessitates behavioral-based detection rather than traditional indicator blocking.