Inside Phexia: A macOS malware delivered through ClickFix

Phexia is a modular macOS backdoor and infostealer actively distributed through ClickFix campaigns since late 2025. The malware employs a multi-stage infection chain beginning with Terminal command execution that downloads shell scripts, establishes persistence via LaunchAgents, and deploys AppleScript-based loaders. A significant evolution occurred in May 2026 when operators began using Polygon blockchain smart contracts as command-and-control dead-drop resolvers, replacing earlier Telegram and Steam-based methods. Post-compromise activities include credential harvesting through fake password prompts, browser data theft, keychain extraction, password manager targeting, and XMRig cryptominer deployment. The malware collects login passwords, browser encryption keys, cookies, and cryptocurrency wallet information. Multiple distinct builds communicate with rotating infrastructure, with reinfection potentially leaving concurrent installations active on compromised endpoints.

• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• False Protection, Emptied Accounts: The Seven Android Trojan Families Targeting Indian Banking AppsMalware2026-10-28
• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05
• Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own TakedownPhishing2026-11-04
• From Business Emails to XLoader: An Order Lure That Led to In-Memory InjectionMalware2026-11-04