A new cybersecurity threat targets Mac users through a deceptive method involving Terminal commands. The malware, known as Phexia, infiltrates systems by tricking users into executing commands from fraudulent web pages.
Phexia’s malicious payload activates when users unwittingly paste a command into Terminal, leading to the unauthorized acquisition of login credentials and sensitive browser and system data. This deceptive technique doesn’t rely on software vulnerabilities, so traditional defenses often fail to detect the threat.
Phexia’s Method of Infiltration
Cybersecurity experts from WithSecure have detailed the progression of Phexia malware in a comprehensive report. The malware has been operational since late 2025, with a noticeable increase in infections during 2026, indicating its sale to multiple cybercriminal groups.
The malware mainly spreads through a social engineering tactic known as ClickFix. Users are directed to bogus verification pages, where they are tricked into self-executing harmful commands. The malware then uses the curl command to download and execute a shell script, often labeled as update.sh or similar variations, hosted on dynamically changing domains.
Technical Aspects and Threat Analysis
Upon execution, the shell script deploys an AppleScript dropper that nestles within the user’s Library folder, ensuring persistent reactivation. The loader, camouflaged with labels mimicking legitimate Apple services, communicates with its server to fetch additional malicious modules.
Once a user’s password is compromised, the malware extracts and transmits browser and password manager data to its command server. It also installs the XMRig Monero miner, further exploiting the system by altering mining pools and wallets.
Blockchain Utilization and Protection Strategies
In a significant development, Phexia began utilizing the Polygon blockchain in May 2026 to obscure its command server address, a method known as EtherHiding. This allows the malware to dynamically update its server location, complicating mitigation efforts.
Security experts advise monitoring for unusual Terminal activity, such as unexpected script downloads and executions, as well as suspicious network connections to blockchain endpoints. Affected users should isolate infected devices, remove malicious software, and reset passwords from secure devices.
This evolving threat underscores the importance of maintaining robust cybersecurity practices and exercising caution when prompted to execute commands from untrusted sources. As attackers continue to refine their methods, staying informed and vigilant remains crucial.
