Phexia Malware Tricks Mac Users into Running Terminal Commands for Credential Theft
A new macOS malware, Phexia, is spreading via social engineering, tricking users into executing Terminal commands that install a backdoor and information stealer.
A sophisticated malware family targeting macOS users, dubbed Phexia, is currently being distributed through deceptive web pages that lure victims into executing commands within the Terminal application. This social engineering tactic, often referred to as ClickFix, bypasses traditional security measures by relying on user action rather than exploiting software vulnerabilities. Once a user pastes and runs the malicious command, Phexia silently installs itself, establishing a backdoor and an information-stealing module designed to harvest sensitive data.
The primary function of Phexia is to steal user credentials, including the macOS login password, browser data from popular browsers like Chrome, Edge, Brave, Opera, and Vivaldi, as well as sensitive information stored in password managers and the macOS Keychain. The malware achieves this by first obtaining the user's login password, often through a persistent "System Preferences" prompt, and then systematically exfiltrating browser cookies, history, saved logins, and password manager extension data. This stolen information is then packaged and sent to command-and-control servers.
Researchers at WithSecure detailed Phexia's operations in a report published on November 4, 2026, noting that the malware has been active since at least late 2025. The firm has observed a significant increase in infections since early 2026, indicating that Phexia is being actively sold and utilized by multiple criminal organizations. The malware's modular design allows it to be updated with new capabilities, making it a versatile tool for various cybercriminal activities.
The infection chain typically begins with a command downloaded and executed via curl and bash. The downloaded script, often named update.sh or similar, is hosted on dynamically generated subdomains. This script then deploys a LaunchAgent, a background process designed to ensure the malware persists and restarts if terminated. To evade detection, the malware's code is stored as Base64 encoded text within the LaunchAgent file, making it unreadable on disk. The naming convention of these LaunchAgents has also evolved, with attackers attempting to mimic legitimate Apple processes.
Beyond credential theft, Phexia operators have also been observed installing the XMRig Monero miner on infected systems. This indicates a multi-faceted monetization strategy, combining direct financial gain from stolen credentials with cryptocurrency mining. The continuous reinstallation of the miner and changes to mining pools and wallets suggest an ongoing effort to maximize profits and evade detection.
A significant advancement in Phexia's operational security is its use of the Polygon blockchain to obscure its command-and-control (C2) server infrastructure. Since May 2026, Phexia has been retrieving its C2 server address from a smart contract on the Polygon network, a technique known as EtherHiding. This method allows attackers to change their C2 server by simply updating the blockchain record, making traditional domain-based blocking ineffective. The malware queries public Polygon endpoints to find the current server address, which can then be used to download further modules or receive commands.
Defenders are advised to monitor for suspicious Terminal activity, LaunchAgents decoding Base64, unusual Polygon network lookups originating from script processes, and repeated dscl password checks. Given the evolving nature of the malware and its C2 infrastructure, file hashes are less reliable indicators of compromise. Instead, behavioral analysis and monitoring for the described activity patterns are recommended. Users should exercise extreme caution and never paste commands from untrusted websites directly into their Terminal.