OTX Threat: Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign

LevelBlue observed a ClickFix campaign delivering Remus Stealer through compromised websites using PhantomPolia, a JavaScript loader that retrieves encrypted configurations from Ethereum Sepolia smart contracts via public RPC endpoints. The loader decrypts configurations locally using PBKDF2 and AES-GCM to obtain C2 domains. Victims are tricked into executing PowerShell commands that retrieve and CVEs: CVE-2026-88771