A malware strain named Phexia has been targeting macOS users by exploiting a social engineering trick: persuading victims to paste terminal commands that silently install the backdoor. Once active, the malware steals login credentials, browser and keychain data, and more.
Phexia’s distribution relies on a tactic dubbed “ClickFix.” Victims encounter a fake verification or system alert on a malicious web page, directing them to copy a command into Terminal. That command downloads a script via curl and passes it to bash, leading to infection without any software vulnerability necessarily being exploited.
Infection Workflow & What’s Being Stolen
First, the malware drops a script (often named update.sh, script.sh, clear-cache.sh, or Terminal.sh) from a web domain and executes it via Terminal. The shell script then runs an AppleScript dropper, which sets up a persistent LaunchAgent in the user’s Library so the malware restarts after being stopped. The LaunchAgent label uses names like com.[16-lowercase-chars] or com.Apple.[16-lowercase-chars]—the latter mimicking Apple naming conventions, but falsely capitalizing the A.
The malware uses dscl to verify login credentials, sometimes via a fake System Preferences prompt that persists until the correct password is entered. The password is stored in a hidden file named .passphrase. Within minutes to hours, Phexia harvests data including browser cookies, history, saved logins across Chrome, Edge, Brave, Opera, Vivaldi, Safari, plus keychain items, LastPass and NordPass extension stores, and more. All that data is zipped and uploaded over plain HTTP to control servers. The operators also deploy XMRig to mine Monero.
New Stealth Techniques & Indicators of Compromise
Since May 2026, Phexia has hidden its command-and-control infrastructure using the Polygon blockchain. The malware reads a smart contract to find the current server address, enabling attackers to swap domains without changing malware code. At least two different smart contracts have been active: one from mid-June through October, and a newer one starting late October that resolves to dhsbdgs[.]icu. This makes domain-based blocking and hash-based detection much less reliable.
Technical indicators to watch out for include: Terminal sessions running shell scripts fetched via curl | bash; LaunchAgents decoding Base64 strings into AppleScript; periodic ledger lookups via public Polygon RPC endpoints; and repeated dscl password prompts. Hosts may have multiple malicious LaunchAgents, even two overlapping builds.
What Users Should Do
If infection is suspected, isolate the Mac immediately. Remove all suspicious LaunchAgents, reset passwords using a clean device, revoke existing sessions, and audit any exposed password manager or wallet data. The campaigns show that even trusted architecture—using Apple tools or standard system features—can be manipulated when users execute unfamiliar Terminal commands.
The Phexia threat underscores the larger trend of attackers leaning on social engineering rather than zero-day vulnerabilities. The malware’s modular nature—sold to multiple criminal groups—and use of blockchain-based server hiding raise the threat level significantly. Users are urged to never run commands from untrusted web pages, especially when prompted by alerts or requests that seem urgent or alarming.
As defenders try to keep up, it becomes crucial to shift detection from static signatures to behavior-based monitoring. Look for patterns like suspicious Terminal commands, mysterious LaunchAgents, use of built-in tools like dscl, and network calls to blockchain or unfamiliar domains. Only by understanding attacker behavior can organizations hope to stay ahead.
