Phexia malware tricks Mac users into running Terminal commands
Phexia steals passwords and browser data from infected macOS machines via ClickFix tricks.
50
Malware
Phexia
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 5, 2026
- Last mentioned6d ago
Timeline
2 articles · newest firstClickFix lures deliver Phexia malware that hides C2 via Polygon contracts
Phexia operators rotate C2 addresses by updating smart contracts; defenders should hunt Terminal commands and LaunchAgents.
40
Appears with
- WithSecurevendor · 2
- mac usersvictim · 1
- macOSproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.