Phexia
Latest
Phexia macOS stealer spreads through fake fixes that trick users into running Terminal commands
Phexia is a modular macOS backdoor and infostealer sold to several criminal groups, with infections rising since early 2026. Victims are lured by ClickFix-style fake verification pages into running a curl command that pipes a script into bash, which installs a LaunchAgent disguised with an Apple-like label. The malware gets the user's password via a fake System Preferences prompt, then steals browser data, keychain files and LastPass and NordPass extension data, and installs the XMRig miner.
ClickFix lures spread Phexia macOS backdoor that uses blockchain-hosted C2
Phexia is a modular macOS backdoor and infostealer sold to multiple threat actors and delivered through ClickFix lures. Victims reach fake verification pages via typosquatted domains and shopping listings, where a copied command starts the infection. Since May 2026, newer builds get their C2 address from a Polygon smart contract, a technique known as EtherHiding.