Phexia macOS stealer spreads through fake fixes that trick users into running Terminal commands
- Severity
- High
- Sources
- 1
What happened
WithSecure reported on 4 November 2026 that Phexia, a macOS backdoor and infostealer in use since at least late 2025, is delivered through ClickFix lures that run curl piped to bash, usually fetching update.sh. The AppleScript dropper writes a Base64-encoded LaunchAgent, with October builds using a label beginning with a capital-A 'com.Apple.' as a spoof. Since May 2026 the C2 address is resolved from a Polygon smart contract (EtherHiding), so blocking domains is insufficient. Hunt for osascript launched from Terminal, LaunchAgents decoding Base64, Polygon RPC lookups from script processes, and dscl password checks. Hashes are of limited use, so rely on behavioural detection.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Never paste commands copied from a website into Terminal.
- Check for LaunchAgents in the user Library folder, especially labels starting with a capital-A 'com.Apple.', and remove any malicious ones.
- If infected, isolate the Mac, reset passwords from a clean device, revoke sessions and review password-manager and wallet exposure.
Written by AI from the sources, checked against them