PhantomPolia: blockchain loader on compromised sites (ClickFix to Remus Stealer, and a checkout card skimmer)

Script injected into compromised websites, dressed up as a tag-manager snippet. It loads the ethers.js library, reads an encrypted value from a smart contract on the Ethereum Sepolia test network through public RPC nodes (EtherHiding: getText()), decrypts it into a host name and loads the next script from that host. The operator changes the host on-chain, and every infected site has its own contract, password and script path. The next stage is XOR-encrypted with a key derived from the infected site's own host name, so it only runs there. On some sites it is a ClickFix lure that asks Windows visitors to paste a PowerShell command, which downloads update.ps1 and installs the Remus infostealer (AutoIt loader, Donut shellcode). On online shops it is a card skimmer: it adds a fake card form styled for the shop's own payment method (card number, expiry, CVV) and sends what is typed to the operator. Seen on small WordPress and WooCommerce sites since at least August 2026; the contracts go back to March 2026. The ClickFix side is described publicly as PhantomPolia.