ClickFix lures deliver Phexia malware that hides C2 via Polygon contracts
Original title: Hackers Use ClickFix Tricks to Infect Macs With Phexia Malware That Hides Through Blockchain Infrastructure
Phexia operators rotate C2 addresses by updating smart contracts; defenders should hunt Terminal commands and LaunchAgents.
Phexia, a modular macOS backdoor, is delivered through ClickFix lures that copy commands to clipboard for execution in Terminal. Newer builds hide C2 by querying Polygon smart contracts using EtherHiding. The malware launches via LaunchAgents, steals credentials and passwords, and deploys XMRig miners.
Unconfirmed: Some contract updates and C2 changes observed by WithSecure with moderate confidence
- Phexia launches AppleScript dropper through osascript from LaunchAgent.
- Loader sends eth_call to Polygon contract 0xA3a6…C2A0 with getServerURL() selector.
- October builds use com.Apple.<16 letters> labels for obfuscation.
- Backdoor captures login password via fake dialog and dscl authonly.
- Operators deploy XMRig 6.26.0 miner and upload software inventory.
Impact: Steals macOS credentials, browser data and installs cryptocurrency miners
- 1.Monitor Terminal commands piped to bash and osascript from LaunchAgents
- 2.Remove all suspicious LaunchAgents and reset stored credentials
- 3.Watch for non-browser processes making Polygon JSON-RPC calls
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.004 Command and Scripting Interpreter: BashT1204.002 User Execution: Malicious File
- Vendors
- WithSecure
- Products
- macOS
- Malware
- Phexia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apdhlhs3.xyz | Category Domain First seen C2 hf98x4d[.]site 14 Jun 2026 C2 apdhlhs3[.]xyz 6 Jul 2026 C2 j9af4sr[.]guru 16 Jul 2026 Delivery host (f |
| domain | bahisbiz.com | provided Delivery host (first-stage shell script) coeuzgoq.bahisbiz[.]com Not provided Delivery host (first-stage shell script) kef |
| domain | dhsbdgs.icu | d queried a second contract, 0x3445…C960, which resolved to dhsbdgs[.]icu. Phexia Malware Attack Contract updates do not redirect e |
| domain | hackersteersman.digital | .]guru 16 Jul 2026 Delivery host (first-stage shell script) hackersteersman[.]digital Not provided Delivery host (first-stage shell script) coe |
| domain | hf98x4d.site | do not redirect existing infections at once. WithSecure saw hf98x4d[.]site still polling on 23 July, about a month after the contrac |
| domain | j9af4sr.guru | hf98x4d[.]site 14 Jun 2026 C2 apdhlhs3[.]xyz 6 Jul 2026 C2 j9af4sr[.]guru 16 Jul 2026 Delivery host (first-stage shell script) hack |
| domain | nextbahis.sex | t provided Delivery host (first-stage shell script) kefavkd.nextbahis[.]sex Not provided Note: IP addresses and domains are intention |
From the original article
3 min read at gbhackers.com
Phexia, a modular macOS backdoor and infostealer sold to multiple threat actors. Operators deliver it through ClickFix lures. Since May 2026, newer builds have taken their command-and-control (C2) address from a Polygon smart contract, a technique known as EtherHiding.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.