Threat video1:00
Phexia macOS Stealer via ClickFix: Detection & IOCs
Phexia resolves its C2 from a Polygon smart contract (EtherHiding) after ClickFix. 9 detection rules, 30 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for Phexia macOS Stealer via ClickFix: Detection & IOCs →
Chapters
- 0:00The hookabout 18 domains via Polygon.
- 0:04The storyClickFix lures deliver Phexia.
- 0:10Attack pathReportedly ClickFix fake page, paste Terminal command.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise28 indicators to hunt: 3 IPs, 18 domains and 1 URL, and more.
- 0:35MITRE ATT&CK techniques20 ATT&CK techniques, from resource development to impact.
- 0:39Remediation5 steps now: Hunt for ~/Library/LaunchAgents plists named com.<16 letters>.plist or com[.]Apple.<16 letters>.plist.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00about 18 domains via Polygon.
0:05ClickFix lures deliver Phexia.
0:07Polygon contract stores C2.
0:10Reportedly ClickFix fake page, paste Terminal command.
0:14Shell script runs AppleScript LaunchAgent.
0:17LaunchAgent calls Polygon contract for C2.
0:20Steals passwords, browser data.
0:24No threat actor is attributed. Confidence: low.
0:2828 indicators to hunt: 3 IPs, 18 domains and 1 URL, and more.
0:3520 ATT&CK techniques, from resource development to impact.
0:405 steps now: Hunt for ~/Library/LaunchAgents plists named com.<16 letters>.plist or com[.]Apple.<16 letters>.plist.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.