Phexia Malware Steals macOS Credentials and Web Records Using Control Networks

EXECUTIVE SUMMARY:

A modular macOS backdoor and information-stealing malware named Phexia is being distributed through ClickFix-based social engineering campaigns targeting macOS environments. The malware is commercially available and has been leveraged by multiple threat actors to compromise macOS devices. Its capabilities extend beyond credential theft, enabling persistent access to infected systems and the deployment of cryptocurrency-mining software. The evolving malware has also adopted blockchain-based command-and-control (C2) resolution, making its infrastructure more difficult to disrupt.

The infection begins when victims are tricked into executing malicious commands in the macOS Terminal, typically through fake CAPTCHA pages and ClickFix instructions. The commands download shell scripts using curl and execute them through bash. The scripts launch an AppleScript dropper that establishes persistence by creating a LaunchAgent under the user's ~/Library/LaunchAgents directory. The embedded loader retrieves command-and-control (C2) addresses through Polygon blockchain smart contracts and downloads the backdoor module for execution. Once active, Phexia communicates with its C2 infrastructure to receive commands and additional payloads. Its capabilities include capturing macOS login passwords, collecting browser credentials, cookies, browsing history, keychain material, and password-manager extension data. The malware also gathers system information and archives stolen data before exfiltrating it to remote infrastructure. Additionally, operators leverage Phexia's tasking mechanism to download and execute XMRig cryptocurrency mining software, repeatedly reinstalling the miner and modifying mining pools and wallet configurations. The malware also supports multiple builds and C2 infrastructure changes, allowing older and newly deployed infections to operate simultaneously on compromised systems.[emaillocker id="1283"]

The campaign demonstrates active development, with operators testing blockchain-based resolvers to evade infrastructure takedowns. The use of smart contracts allows C2 redirection without modifying deployed malware, making historical domains less reliable for detection. Multiple builds have been observed operating concurrently on single endpoints, complicating incident response. Defenders should monitor for LaunchAgent persistence with obfuscated AppleScript loaders and unusual Terminal execution patterns. Detection logic must account for the dynamic nature of the C2 infrastructure and the specific process ancestry associated with the initial download and execution steps.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://cybersecuritynews.com/hackers-trick-mac-users/
• https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware/