ClickFix lures spread Phexia macOS backdoor that uses blockchain-hosted C2
MALWAREPhexiaredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Phexia is a modular macOS backdoor and infostealer sold to multiple threat actors and delivered via ClickFix lures hosted on typosquatted domains and fake shopping listings. The lure page copies a malicious command to the clipboard for the victim to run. Since May 2026, newer builds resolve their command-and-control address from a Polygon smart contract (EtherHiding), which complicates domain-based blocking. The article is truncated, so further IOCs and remediation details are not available here. Defenders should monitor for clipboard-driven command execution on macOS and review egress to Polygon blockchain RPC endpoints.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Be wary of verification pages or shopping listings on unfamiliar or lookalike domains that ask you to copy and run a command.
- Do not paste and run commands copied from a web page unless you understand what they do.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Malware