How the Phexia macOS infostealer spreads via ClickFix, hides C2 in Polygon smart contracts, and how to detect and remove it. Includes IOCs and MITRE mapping.

Phexia macOS malware uses ClickFix scams to steal passwords, browser data, and keychain files through malicious Terminal commands.

ハッカーがClickFix攻撃を使い、macOS向けのモジュール型バックドア「Phexia」をインストールさせています。Phexiaはパスワードを盗み、ブラウザーのデータを収集し、暗号資産のマイナーを展開します。 WithSecureの調査によると、この商用販売されているマルウェアは、少なくとも2025年後半から複数

A macOS malware family called Phexia is spreading through fake web pages that talk Mac users into pasting a command into Terminal. Once the command runs, the malware quietly settles on the Mac, steals the login password, and copies browser data, keychain files, and password-manager extension data. The trick is known as ClickFix. A page shows a fake verification or fix, and the user performs the dangerous step themselves. No software flaw is needed, so the usual protections have little to catch. Phexia is sold to several criminal groups, which is why more infections keep appearing. Analysts at WithSecure identified and detailed the malware in a report published on November 4, 2026. They say Phexia is a modular backdoor and information stealer that has been in use since at least late 2025. The firm has seen a growing number of infections since early 2026, which suggests more criminals are buying it. Hackers Trick Mac Users Into Running Terminal Commands In nearly every case WithSecure could examine, the infection started with a command typed into Terminal. The command used curl to download a shell script and sent it straight to bash. The script was usually named update.sh, though script.sh, clear-cache.sh, and Terminal.sh also appeared. It was hosted on random-looking subdomains that changed between waves. The team tied one July 6 infection to a typosquatted domain, which points to look-alike web addresses as a likely delivery route. The same trick has appeared in a fake CAPTCHA Mac campaign that also ended in password theft and cryptomining. Overview of the latest Phexia infection chain (Source – With Secure) The script then runs an AppleScript dropper. The dropper writes a LaunchAgent into the user’s Library folder and sets it to restart whenever it stops. The loader is stored as Base64 text inside that file, so no readable script sits on the disk. Builds from June to mid-September used a label of “com.” plus 16 lowercase letters. October builds switched to “com.Apple.” plus 16 letters, to look like a real Apple item. The capital “A” gives it away, because genuine Apple labels use lowercase. After setup, the backdoor checks in with its server and asks for more modules. A tool called dscl tests whether the entered login password is correct, and a fake “System Preferences” prompt can keep asking until the right one is typed. The password is saved in a hidden file named .passphrase. WithSecure saw this happen anywhere from under a minute to about eight minutes after infection. Some checks began 22 hours later and repeated on following days. With the password in hand, the stealer copies the data it wants. It reads browser “Safe Storage” keys for Chrome, Edge, Brave, Opera, and Vivaldi, and copies cookies, history, and saved login files. It also takes LastPass and NordPass extension stores, the login keychain, and Safari cookies. Everything is zipped and uploaded to the command server and to a second server at 62.60.226[.]50 over plain HTTP. The operators also install the XMRig Monero miner. They keep reinstalling it and changing mining pools and wallets. Similar password-grabbing tricks showed up in the MacSync macOS infostealer , so the method is clearly popular among Mac malware sellers. Polygon Blockchain Hides the Command Server The biggest recent change came in May 2026. Phexia began reading its server address from a smart contract on the Polygon blockchain, a method called EtherHiding. The loader holds no fixed server name. It asks public Polygon endpoints for the current address and then requests its next module from that host. The operator can swap in a new server by sending one blockchain transaction. Blocking a domain therefore does not remove the pointer, and the malware just looks up the next address. WithSecure saw one contract used from June 14 to October 22. A different contract appeared on October 27 and resolved to dhsbdgs[.]icu. Old infections did not move to new servers right away. Machines kept contacting an older domain for about a month after the contract changed. When a Mac was infected again, two builds ran side by side, and the earlier one kept receiving tasks for more than 20 minutes. Defenders should therefore keep old indicators in their searches and check for several LaunchAgents on one Mac. File hashes help little here, because the malware uses built-in Apple tools and every build is obfuscated differently. WithSecure recommends watching behavior instead. Look for Terminal sessions that download scripts and then launch osascript, LaunchAgents that decode Base64 into osascript, Polygon lookups from script processes, and dscl password checks. Affected users should isolate the Mac, remove every malicious LaunchAgent, reset passwords from a clean device, revoke sessions, and review password-manager and wallet exposure. The newer ClickFix abuse of Script Editor shows how fast attackers change the entry point, and the Atomic Stealer ClickFix campaign shows the same social trick. Users should never paste commands from a website into Terminal. Indicators of compromise (IoCs):- Type Indicator Note Polygon contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 Used with selector 0x2686ecea, June to October 2026 Polygon contract 0x3445fB8Df432320251f611e691fe6B0C6664C960 Used by a build installed October 27; resolved to dhsbdgs[.]icu Polygon RPC endpoints polygon.drpc[.]org, polygon.publicnode[.]com, polygon-mainnet.gateway.tatum[.]io, tenderly.rpc.polygon[.]community Legitimate services; suspicious only when contacted by osascript C2 domains hf98x4d[.]site, apdhlhs3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sgxv[.]lol, d9mjs[.]sbs First seen June to September 2026 C2 domains jse8x92s[.]me, couhe79[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshnik[.]top, svo-zv[.]pro, dhsbdgs[.]icu First seen September to October 2026 Delivery hosts hackersteersman[.]digital, coeuzgoq.bahisbiz[.]com, kefavkd.nextbahis[.]sex, d9j.everunningshoes[.]com, nox.usa-synadentix[.]com, zwa8.meritbethizligir[.]com, 355uz90z.bolnhurstrally[.]site, 7ulk.irvinaurus[.]fit Host the first-stage scripts Script names update.sh, script.sh, clear-cache.sh, Terminal.sh First-stage scripts Upload server 62.60.226[.]50 Plain HTTP upload.php Mining pools pool.hashvault[.]sh:443, pool.supportxmr[.]com:3333 XMRig 6.26.0 Monero wallet 4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L Miner wallet Monero wallet 82hSZSZNcbCdWd3ESkMDnC5cegaJnFhcG8PUBkMPof5mEdMDCF8cLcE1QuW4h82ggwi4qtfnRwMEgZPKQEnogkvmLFuRLFv Miner wallet Host artifacts ~/Library/LaunchAgents/com.<16 letters>.plist and com.Apple.<16 letters>.plist Persistence Host artifacts ~/.passphrase, ~/.txid, ~/tempFolderC/, /tmp/<long hex>.zip, /tmp/updstat.txt, /tmp/rigupdater/, /tmp/applecomlistupdate/ Password, build ID, staging, and miner folders Note:   IP addresses and domains are intentionally Qdefanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware appeared first on Cyber Security News .

De macOS-malware Phexia, die sinds eind 2025 actief is en sinds begin 2026 steeds vaker voorkomt, wordt verkocht aan criminele groepen, wat resulteert in aanhoudende infecties. De infectie wordt doorgaans geïnitieerd wanneer Mac-gebruikers een commando in de Terminal plakken. Dit commando maakt gebruik van `curl` om een shellscript te downloaden dat direct met `bash` wordt uitgevoerd. Deze methode, ClickFix genaamd, presenteert een valse verificatie of oplossing, waarna de gebruiker onbewust de schadelijke stap uitvoert. Een typosquatted domein is een voorbeeld van een dergelijke misleidende leveringsmethode, zoals waargenomen bij een infectie op 6 juli 2026. De gedownloade shellscripts, v...

Darktrace says the first half of 2026 was defined by attackers abusing trusted identities, SaaS, cloud entitlements, AI systems, and supply-chain relationships rather than relying on traditional exploitation, with one React2Shell honeypot compromised in under two hours. Campaigns involving StealC, AMOS, Phexia, Axios, Trivy, Hola VPN, BeyondTrust, and JadePuffer showed how quickly trust-based tradecraft, AI-generated malware, and supply-chain abuse are reshaping intrusion paths. #React2Shell #Darktrace #StealC #AMOS #Phexia #Axios #Trivy #HolaVPN #BeyondTrust #JadePuffer

How to use Clickfix to implant an AppleScript based Bot on MacOS

Proper Guide For Advertising App Elimination Phexia is a dangerous type of computer virus specifically designed to attack Apple Mac computers. It acts like a digital spy, quietly infiltrating your system to watch everything you do. Its main goal is to remain hidden for as long as possible while it carries out its harmful tasks. The detailed guiding procedure has been discussed here to remove Phexia from your Mac completely. Follow the process and every step very carefully.