Phexia macOS stealer spreads through fake fixes that trick users into running Terminal commands
MALWAREPhexiaredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A password-stealing program called Phexia is infecting Macs through fake web pages that ask users to paste a command into the Terminal app. Once the command runs, the malware takes the user's login password and copies saved browser data and password-manager details. Users should never paste commands from a website into Terminal.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Never paste commands copied from a website into Terminal.
- Check for LaunchAgents in the user Library folder, especially labels starting with a capital-A 'com.Apple.', and remove any malicious ones.
- If infected, isolate the Mac, reset passwords from a clean device, revoke sessions and review password-manager and wallet exposure.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News