Phexia malware tricks Mac users into running Terminal commands
Original title: Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware
AI summary · x-ai/grok-4.7Summaries by Vani AI
Phexia steals passwords and browser data from infected macOS machines via ClickFix tricks.
A macOS malware family called Phexia spreads through fake web pages that trick users into pasting commands into Terminal. The malware downloads a shell script that runs an AppleScript dropper, sets up a LaunchAgent, and steals login passwords and browser data. It uses a Polygon blockchain contract for server addresses and has been active since late 2025.
Key facts
- Infections start with curl downloading update.sh or similar scripts.
- Malware copies browser cookies, keychains, and password manager data.
- It uses dscl to verify passwords and installs XMRig miner.
- Server addresses read from Polygon smart contracts via EtherHiding.
- WithSecure analyzed infections starting in early 2026.
Security assessment · AI, from the articleExploited in the wild
Impact: Steals login passwords and browser data
| Product | Affected |
|---|---|
| Apple macOS | various |
What to do
- 1.Never paste commands from websites into Terminal
- 2.Isolate infected Mac and remove malicious LaunchAgents
- 3.Reset passwords from a clean device
- Vendors
- WithSecure
- Malware
- Phexia
- Victims
- mac users
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 67sixcebeh.surf | C2 domains hf98x4d[.]site, apdhlhs3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sgxv[.]lol, d9mjs[.]sbs First seen Ju |
| domain | apdhlhs3.xyz | only when contacted by osascript C2 domains hf98x4d[.]site, apdhlhs3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sg |
| domain | bahisbiz.com | ber 2026 Delivery hosts hackersteersman[.]digital, coeuzgoq.bahisbiz[.]com, kefavkd.nextbahis[.]sex, d9j.everunningshoes[.]com, nox. |
| domain | bolnhurstrally.site | usa-synadentix[.]com, zwa8.meritbethizligir[.]com, 355uz90z.bolnhurstrally[.]site, 7ulk.irvinaurus[.]fit Host the first-stage scripts Scrip |
| domain | couhe79.xyz | First seen June to September 2026 C2 domains jse8x92s[.]me, couhe79[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshnik[.]top, svo-z |
| domain | d9mjs.sbs | r[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sgxv[.]lol, d9mjs[.]sbs First seen June to September 2026 C2 domains jse8x92s[.]m |
| domain | dhsbdgs.icu | A different contract appeared on October 27 and resolved to dhsbdgs[.]icu. Old infections did not move to new servers right away. M |
| domain | drpc.org | 27; resolved to dhsbdgs[.]icu Polygon RPC endpoints polygon.drpc[.]org, polygon.publicnode[.]com, polygon-mainnet.gateway.tatum[ |
| domain | everunningshoes.com | ital, coeuzgoq.bahisbiz[.]com, kefavkd.nextbahis[.]sex, d9j.everunningshoes[.]com, nox.usa-synadentix[.]com, zwa8.meritbethizligir[.]com, 3 |
| domain | hackersteersman.digital | s[.]icu First seen September to October 2026 Delivery hosts hackersteersman[.]digital, coeuzgoq.bahisbiz[.]com, kefavkd.nextbahis[.]sex, d9j.ev |
| domain | hashvault.sh | rver 62.60.226[.]50 Plain HTTP upload.php Mining pools pool.hashvault[.]sh:443, pool.supportxmr[.]com:3333 XMRig 6.26.0 Monero walle |
| domain | hf98x4d.site | ces; suspicious only when contacted by osascript C2 domains hf98x4d[.]site, apdhlhs3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4e |
| domain | irvinaurus.fit | eritbethizligir[.]com, 355uz90z.bolnhurstrally[.]site, 7ulk.irvinaurus[.]fit Host the first-stage scripts Script names update.sh, scri |
| domain | j9af4sr.guru | ted by osascript C2 domains hf98x4d[.]site, apdhlhs3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sgxv[.]lol, d9mjs[ |
| domain | jse8x92s.me | l, d9mjs[.]sbs First seen June to September 2026 C2 domains jse8x92s[.]me, couhe79[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshn |
| domain | meritbethizligir.com | , d9j.everunningshoes[.]com, nox.usa-synadentix[.]com, zwa8.meritbethizligir[.]com, 355uz90z.bolnhurstrally[.]site, 7ulk.irvinaurus[.]fit Ho |
| domain | nextbahis.sex | hackersteersman[.]digital, coeuzgoq.bahisbiz[.]com, kefavkd.nextbahis[.]sex, d9j.everunningshoes[.]com, nox.usa-synadentix[.]com, zwa |
| domain | oreshnik.top | 92s[.]me, couhe79[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshnik[.]top, svo-zv[.]pro, dhsbdgs[.]icu First seen September to Octo |
| domain | polygon.community | ode[.]com, polygon-mainnet.gateway.tatum[.]io, tenderly.rpc.polygon[.]community Legitimate services; suspicious only when contacted by os |
| domain | publicnode.com | dgs[.]icu Polygon RPC endpoints polygon.drpc[.]org, polygon.publicnode[.]com, polygon-mainnet.gateway.tatum[.]io, tenderly.rpc.polygon |
| domain | secdarvin2026.icu | 2026 C2 domains jse8x92s[.]me, couhe79[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshnik[.]top, svo-zv[.]pro, dhsbdgs[.]icu First seen S |
| domain | stv4ec5.shop | [.]site, apdhlhs3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sgxv[.]lol, d9mjs[.]sbs First seen June to September |
| domain | supportxmr.com | HTTP upload.php Mining pools pool.hashvault[.]sh:443, pool.supportxmr[.]com:3333 XMRig 6.26.0 Monero wallet 4ApYm7Cp1QKHYd34eWHTLMR9J |
| domain | svo-zv.pro | 9[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshnik[.]top, svo-zv[.]pro, dhsbdgs[.]icu First seen September to October 2026 Deliv |
| domain | tatum.io | pc[.]org, polygon.publicnode[.]com, polygon-mainnet.gateway.tatum[.]io, tenderly.rpc.polygon[.]community Legitimate services; su |
| domain | usa-synadentix.com | om, kefavkd.nextbahis[.]sex, d9j.everunningshoes[.]com, nox.usa-synadentix[.]com, zwa8.meritbethizligir[.]com, 355uz90z.bolnhurstrally[.]s |
| domain | vg5sgxv.lol | 3[.]xyz, j9af4sr[.]guru, 67sixcebeh[.]surf, stv4ec5[.]shop, vg5sgxv[.]lol, d9mjs[.]sbs First seen June to September 2026 C2 domains |
| domain | xzttyt.xyz | to September 2026 C2 domains jse8x92s[.]me, couhe79[.]xyz, xzttyt[.]xyz, secdarvin2026[.]icu, oreshnik[.]top, svo-zv[.]pro, dhsbd |
| ipv4 | 62.60.226.50 | nd uploaded to the command server and to a second server at 62.60.226[.]50 over plain HTTP. The operators also install the XMRig Mon |
From the original article
5 min read at cybersecuritynews.com
A macOS malware family called Phexia is spreading through fake web pages that talk Mac users into pasting a command into Terminal. Once the command runs, the malware quietly settles on the Mac, steals the login password, and copies browser data, keychain files, and password-manager extension data. The trick is known as ClickFix.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.