XaocMail ClickFix shared-document lures on Cloudflare Workers delivering the Phantom53 implant

Phishing e-mails dressed as a document-sharing notice (Google Docs, Adobe Acrobat, Office 365 or a "secured document") link each recipient to their own page on a Cloudflare Worker. The page shows a blurred copy of the document behind a fake reCAPTCHA or browser check and asks the visitor to press Win+R and paste a "verification token", which is really a PowerShell, mshta or msiexec command. The command installs an MSI that sets up the Phantom53 implant (a bundled Python runtime run by two scheduled tasks that reach their operator over DNS-over-HTTPS), which can later load a Havoc agent. While it installs, the page unblurs so the visitor sees the document they expected. Earlier lures delivered a ZIP with a sideloaded Notepad++ updater instead of the MSI. Seen from February to November 2026 on securedoc[.]makeneg458[.]workers[.]dev, securedoc[.]mesuttgulerr573[.]workers[.]dev and further Workers handed out by a link rotator. A match means a page built from this kit, one of its stagers, or one of its known hosts.