Phexia macOS Malware Uses ClickFix and Blockchain for Infections
What's new
First merged summary.
Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI
Phexia steals passwords and deploys XMRig miners on macOS via ClickFix and Polygon smart contract C2.
Phexia is a modular macOS backdoor that spreads through ClickFix lures tricking users into pasting Terminal commands. It hides C2 addresses by querying Polygon smart contracts with EtherHiding and uses LaunchAgents for persistence. The malware steals credentials, browser data, and passwords before deploying XMRig miners. Infections began in late 2025 and were active into early 2026.
Key facts
- Delivered via ClickFix Terminal command tricks
- C2 from Polygon contract 0xA3a6…C2A0 via EtherHiding
- Steals passwords using dscl and fake dialogs
- Deploys XMRig 6.26.0 miner
- Launches via AppleScript dropper and LaunchAgent
- October builds use com.Apple.<16 letters> obfuscation
Timeline
dated events in the reporting · oldest first- Dec 31, 2025Phexia active since late 2025 · Cyber Security News
- Nov 5, 2026ClickFix infections reported with smart contract C2 · GBHackers
- Nov 5, 2026Infections analyzed by WithSecure since early 2026 · Cyber Security News
What each outlet adds
beyond the shared facts- GBHackersSmart contract address, XMRig miner version, LaunchAgent details
- Cyber Security NewsWithSecure analysis start date, browser cookies and keychains theft
- Vendors
- WithSecure
- Products
- macOS
- Malware
- Phexia
- Victims
- mac users
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
ClickFix lures deliver Phexia malware that hides C2 via Polygon contracts
Phexia operators rotate C2 addresses by updating smart contracts; defenders should hunt Terminal commands and LaunchAgents.
- · 6d ago
Cyber Security News
Phexia malware tricks Mac users into running Terminal commands
Phexia steals passwords and browser data from infected macOS machines via ClickFix tricks.