Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware

A macOS malware family called Phexia is spreading through fake web pages that talk Mac users into pasting a command into Terminal.

Once the command runs, the malware quietly settles on the Mac, steals the login password, and copies browser data, keychain files, and password-manager extension data.

The trick is known as ClickFix. A page shows a fake verification or fix, and the user performs the dangerous step themselves. No software flaw is needed, so the usual protections have little to catch.

Phexia is sold to several criminal groups, which is why more infections keep appearing. Analysts at WithSecure identified and detailed the malware in a report published on November 4, 2026.

They say Phexia is a modular backdoor and information stealer that has been in use since at least late 2025. The firm has seen a growing number of infections since early 2026, which suggests more criminals are buying it.

Hackers Trick Mac Users Into Running Terminal Commands

In nearly every case WithSecure could examine, the infection started with a command typed into Terminal. The command used curl to download a shell script and sent it straight to bash.

The script was usually named update.sh, though script.sh, clear-cache.sh, and Terminal.sh also appeared. It was hosted on random-looking subdomains that changed between waves.

The team tied one July 6 infection to a typosquatted domain, which points to look-alike web addresses as a likely delivery route. The same trick has appeared in a fake CAPTCHA Mac campaign that also ended in password theft and cryptomining.

The script then runs an AppleScript dropper. The dropper writes a LaunchAgent into the user’s Library folder and sets it to restart whenever it stops.

The loader is stored as Base64 text inside that file, so no readable script sits on the disk. Builds from June to mid-September used a label of “com.” plus 16 lowercase letters. October builds switched to “com.Apple.” plus 16 letters, to look like a real Apple item.

The capital “A” gives it away, because genuine Apple labels use lowercase. After setup, the backdoor checks in with its server and asks for more modules.

A tool called dscl tests whether the entered login password is correct, and a fake “System Preferences” prompt can keep asking until the right one is typed.

The password is saved in a hidden file named .passphrase. WithSecure saw this happen anywhere from under a minute to about eight minutes after infection. Some checks began 22 hours later and repeated on following days.

With the password in hand, the stealer copies the data it wants. It reads browser “Safe Storage” keys for Chrome, Edge, Brave, Opera, and Vivaldi, and copies cookies, history, and saved login files.

It also takes LastPass and NordPass extension stores, the login keychain, and Safari cookies. Everything is zipped and uploaded to the command server and to a second server at 62.60.226[.]50 over plain HTTP.

The operators also install the XMRig Monero miner. They keep reinstalling it and changing mining pools and wallets. Similar password-grabbing tricks showed up in the MacSync macOS infostealer, so the method is clearly popular among Mac malware sellers.

Polygon Blockchain Hides the Command Server

The biggest recent change came in May 2026. Phexia began reading its server address from a smart contract on the Polygon blockchain, a method called EtherHiding.

The loader holds no fixed server name. It asks public Polygon endpoints for the current address and then requests its next module from that host.

The operator can swap in a new server by sending one blockchain transaction. Blocking a domain therefore does not remove the pointer, and the malware just looks up the next address.

WithSecure saw one contract used from June 14 to October 22. A different contract appeared on October 27 and resolved to dhsbdgs[.]icu.

Old infections did not move to new servers right away. Machines kept contacting an older domain for about a month after the contract changed.

When a Mac was infected again, two builds ran side by side, and the earlier one kept receiving tasks for more than 20 minutes. Defenders should therefore keep old indicators in their searches and check for several LaunchAgents on one Mac.

File hashes help little here, because the malware uses built-in Apple tools and every build is obfuscated differently. WithSecure recommends watching behavior instead.

Look for Terminal sessions that download scripts and then launch osascript, LaunchAgents that decode Base64 into osascript, Polygon lookups from script processes, and dscl password checks.

Affected users should isolate the Mac, remove every malicious LaunchAgent, reset passwords from a clean device, revoke sessions, and review password-manager and wallet exposure.

The newer ClickFix abuse of Script Editor shows how fast attackers change the entry point, and the Atomic Stealer ClickFix campaign shows the same social trick. Users should never paste commands from a website into Terminal.

Indicators of compromise (IoCs):-

Type	Indicator	Note
Polygon contract	0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0	Used with selector 0x2686ecea, June to October 2026
Polygon contract	0x3445fB8Df432320251f611e691fe6B0C6664C960	Used by a build installed October 27; resolved to dhsbdgs[.]icu
Polygon RPC endpoints	polygon.drpc[.]org, polygon.publicnode[.]com, polygon-mainnet.gateway.tatum[.]io, tenderly.rpc.polygon[.]community	Legitimate services; suspicious only when contacted by osascript
C2 domains	hf98x4d[.]site, apdhlhs3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sgxv[.]lol, d9mjs[.]sbs	First seen June to September 2026
C2 domains	jse8x92s[.]me, couhe79[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshnik[.]top, svo-zv[.]pro, dhsbdgs[.]icu	First seen September to October 2026
Delivery hosts	hackersteersman[.]digital, coeuzgoq.bahisbiz[.]com, kefavkd.nextbahis[.]sex, d9j.everunningshoes[.]com, nox.usa-synadentix[.]com, zwa8.meritbethizligir[.]com, 355uz90z.bolnhurstrally[.]site, 7ulk.irvinaurus[.]fit	Host the first-stage scripts
Script names	update.sh, script.sh, clear-cache.sh, Terminal.sh	First-stage scripts
Upload server	62.60.226[.]50	Plain HTTP upload.php
Mining pools	pool.hashvault[.]sh:443, pool.supportxmr[.]com:3333	XMRig 6.26.0
Monero wallet	4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L	Miner wallet
Monero wallet	82hSZSZNcbCdWd3ESkMDnC5cegaJnFhcG8PUBkMPof5mEdMDCF8cLcE1QuW4h82ggwi4qtfnRwMEgZPKQEnogkvmLFuRLFv	Miner wallet
Host artifacts	~/Library/LaunchAgents/com.<16 letters>.plist and com.Apple.<16 letters>.plist	Persistence
Host artifacts	~/.passphrase, ~/.txid, ~/tempFolderC/, /tmp/<long hex>.zip, /tmp/updstat.txt, /tmp/rigupdater/, /tmp/applecomlistupdate/	Password, build ID, staging, and miner folders

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.