Phexia macOS stealer spread via ClickFix Terminal commands, report says

What happened

According to Cyber Security News, the security firm WithSecure published a report on November 4, 2026 describing a macOS malware family called Phexia. Fake web pages show a bogus verification or fix and persuade Mac users to paste a command into Terminal. This technique is known as ClickFix. Cyber Security News says no software flaw is involved, because the user runs the dangerous step themselves. The findings come from one outlet summarising one vendor report, and no other source in this advisory has verified them independently.

WithSecure describes Phexia as a modular backdoor and information stealer that has been in use since at least late 2025. The firm reports that infections have grown since early 2026 and says the malware is sold to several criminal groups, according to Cyber Security News.

The infection chain, as reported by Cyber Security News:

• The Terminal command uses curl to download a shell script and passes it straight to bash. The script is usually named update.sh. The names script.sh, clear-cache.sh and Terminal.sh also appeared. WithSecure linked one infection to a typosquatted domain.
• An AppleScript dropper writes a LaunchAgent into the user’s Library folder. The loader is stored inside that file as Base64 text. Earlier builds used a label of “com.” followed by 16 lowercase letters. October builds used “com.Apple.” followed by 16 letters. The report notes that genuine Apple labels use a lowercase “apple”.
• A fake “System Preferences” prompt asks for the login password, and the tool dscl checks whether it is correct. The password is then saved to a hidden file named .passphrase.
• The stealer collects the following data:
  • browser “Safe Storage” keys for Chrome, Edge, Brave, Opera and Vivaldi
  • cookies, history and saved logins
  • LastPass and NordPass extension data
  • the login keychain
  • Safari cookies
• The stolen data is uploaded over plain HTTP. The operators also install the XMRig Monero miner.

Cyber Security News reports that since May 2026, Phexia has read its command server address from a smart contract on the Polygon blockchain, a technique called EtherHiding. This lets operators switch servers with a single blockchain transaction, so blocking one domain does not cut off the malware. WithSecure also saw infected Macs keep contacting an older domain for about a month after a contract change.

Am I affected?

You may be affected if you pasted a curl command from a web page into Terminal. Cyber Security News lists these signs, based on WithSecure’s findings (source):

• LaunchAgents in ~/Library/LaunchAgents named com.<16 letters>.plist or com.Apple.<16 letters>.plist. Look for a capital “A” in particular. There may be more than one.
• The files or folders ~/.passphrase, ~/.txid, ~/tempFolderC/, /tmp/updstat.txt, /tmp/rigupdater/ or /tmp/applecomlistupdate/.
• Connections to the upload server 62.60.226[.]50.
• Connections to command domains such as dhsbdgs[.]icu, oreshnik[.]top, secdarvin2026[.]icu or hf98x4d[.]site. The full list is in the source.
• Polygon RPC lookups made by osascript.
• Connections to the mining pools pool.hashvault[.]sh or pool.supportxmr[.]com.

According to the report, file hashes are of limited use because every build is obfuscated differently. WithSecure recommends watching for behaviour instead.

What to do now

1. Do not paste commands from websites into Terminal, whatever the page claims to fix or verify.
2. If you suspect an infection, isolate the Mac from the network. This step is recommended in the Cyber Security News report.
3. Remove every malicious LaunchAgent. WithSecure saw multiple builds running side by side on a reinfected Mac.
4. From a clean device, reset your passwords, starting with your macOS login password and any passwords stored in browsers or in LastPass or NordPass. Then revoke active sessions.
5. Review your exposure in password managers and cryptocurrency wallets.
6. Defenders should hunt for the following behaviour:
   • Terminal sessions that download scripts and then launch osascript
   • LaunchAgents that decode Base64 into osascript
   • Polygon RPC lookups from script processes
   • dscl password checks

Keep older indicators in searches, because infected Macs kept contacting old servers after a change, according to Cyber Security News.

Sources

• Cyber Security News: Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware