Phexia macOS stealer spreads through fake fixes that trick users into running Terminal commands
MALWAREPhexiaredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Phexia is a modular macOS backdoor and infostealer sold to several criminal groups, with infections rising since early 2026. Victims are lured by ClickFix-style fake verification pages into running a curl command that pipes a script into bash, which installs a LaunchAgent disguised with an Apple-like label. The malware gets the user's password via a fake System Preferences prompt, then steals browser data, keychain files and LastPass and NordPass extension data, and installs the XMRig miner.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Never paste commands copied from a website into Terminal.
- Check for LaunchAgents in the user Library folder, especially labels starting with a capital-A 'com.Apple.', and remove any malicious ones.
- If infected, isolate the Mac, reset passwords from a clean device, revoke sessions and review password-manager and wallet exposure.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News