Phexia stealer host, network and wallet discovery from osascript descendants
Detects a sequence of discovery commands typical of the Phexia macOS stealer, including system_profiler hardware/software/display profiles, public IP lookups via api.ipify.org, and cryptocurrency wallet or file extension probing executed within a short time window via command shells or script interpreters.
Microsoft Sentinel (KQL)
