ClickFix lures spread Phexia macOS backdoor that uses blockchain-hosted C2
MALWAREPhexiaredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Phexia is a modular macOS backdoor and infostealer sold to multiple threat actors and delivered through ClickFix lures. Victims reach fake verification pages via typosquatted domains and shopping listings, where a copied command starts the infection. Since May 2026, newer builds get their C2 address from a Polygon smart contract, a technique known as EtherHiding.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Be wary of verification pages or shopping listings on unfamiliar or lookalike domains that ask you to copy and run a command.
- Do not paste and run commands copied from a web page unless you understand what they do.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Malware