Hackers Use ClickFix Tricks to Infect Macs With Phexia Malware That Hides Through Blockchain Infrastructure

Phexia, a modular macOS backdoor and infostealer sold to multiple threat actors. Operators deliver it through ClickFix lures.

Since May 2026, newer builds have taken their command-and-control (C2) address from a Polygon smart contract, a technique known as EtherHiding.

Victims reach fake verification pages through typosquatted domains and shopping listings. The page copies a command to the clipboard and tells the user to run it in Terminal.

The command pipes a shell script, often named update.sh, script.sh or clear-cache.sh, into bash. WithSecure tied infections on 6 July 2026 to the exact delivery URL, with its double slash.

The script launches an AppleScript dropper through osascript. The dropper writes a LaunchAgent to the user’s Library folder with KeepAlive and RunAtLoad set, and the base64-encoded loader sits inside the plist.

Builds from June to mid-September used labels like com.<16 letters>. October builds switched to com.Apple.<16 letters>, with a capitalised “Apple” that differs from Apple’s genuine lowercase namespace and gives defenders a hunting indicator.

The loader holds no hardcoded C2. It sends an eth_call to the Polygon contract 0xA3a6…C2A0, using the getServerURL() selector 0x2686ecea, through four public RPC endpoints in sequence.

It decodes the returned hostname and requests “bmodule”, which it pipes straight into osascript. Researcher pamoutaf had described the same mechanism earlier, noting that a domain can be reported and taken down but the contract cannot.

WithSecure Researchers said that, the operator rotates infrastructure by calling setServerURL() on the contract. Blockscout records show the C2 value changing repeatedly in June and July 2026.

On 27 October, a reinfection build queried a second contract, 0x3445…C960, which resolved to dhsbdgs[.]icu.

Phexia Malware Attack

Contract updates do not redirect existing infections at once. WithSecure saw hf98x4d[.]site still polling on 23 July, about a month after the contract pointed elsewhere.

Endpoints appear to refresh their C2 only when the loader restarts. Reinfection can also leave old and new LaunchAgents running side by side.

The backdoor shows a fake “System Preferences” dialog to capture the login password. It validates the password with dscl . authonly, which exposes it in command-line telemetry, and stores it in ~/.passphrase.

WithSecure saw capture attempts begin about 22 hours after infection and recur on later days.

The stealer modules then take browser Safe Storage secrets, cookies and login databases, LastPass and NordPass extension stores, and the login keychain.

They archive the data with ditto and upload it to the C2 over HTTPS. A second copy goes over plain HTTP to 62.60.226[.]50.

Public analysis shows the same IP hosting a WebSocket remote-shell agent and a fake Ledger Wallet app aimed at seed phrases.

WithSecure also found C2 tasking that deployed XMRig 6.26.0. Each run killed any existing miner and reinstalled it. The operator switched from HashVault to SupportXMR and used two wallets across 20 to 26 October.

From 20 October, the backdoor also uploaded a software inventory, which WithSecure believes, with moderate confidence, helps the operator choose tasks.

Because Phexia relies on native Apple utilities and per-build obfuscation, file hashes alone are weak detections. Defenders should hunt for these behaviours:

Monitor for Terminal-spawned curl commands piped to bash, osascript execution originating from LaunchAgents that decode Base64 content, both LaunchAgent label formats, non-browser processes making Polygon JSON-RPC calls, dscl authonly invocations containing a plaintext password, and writes to ~/.passphrase.

Responders should remove every LaunchAgent, including older labels, and treat historical C2 domains as live indicators.

They should also reset passwords and rotate any credentials, session cookies and wallet secrets stored on the Mac. Pamoutaf noted that killing only the osascript process is not enough, because launchd respawns it and the loader can run duplicate beacon processes.

IOCs

Category	Domain	First seen
C2	hf98x4d[.]site	14 Jun 2026
C2	apdhlhs3[.]xyz	6 Jul 2026
C2	j9af4sr[.]guru	16 Jul 2026
Delivery host (first-stage shell script)	hackersteersman[.]digital	Not provided
Delivery host (first-stage shell script)	coeuzgoq.bahisbiz[.]com	Not provided
Delivery host (first-stage shell script)	kefavkd.nextbahis[.]sex	Not provided

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.