Executive Summary
A sophisticated macOS campaign, identified as Phexia and utilizing the 'EtherHiding' technique, is targeting users via fake verification pages (e.g., CloudKey, Meridian) delivered through domains like bazinga[.]biz. Once a user follows the 'ClickFix' instructions—pasting a malicious command into Terminal—a multi-stage infection process begins, resulting in a persistent backdoor and the deployment of modular infostealers.
The attack is notable for its use of Web3 infrastructure; the malware does not contain a hardcoded C2 domain but instead queries a Polygon smart contract (0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0) via public RPC services to resolve its current command server. This allows attackers to update infrastructure without modifying the malware on disk. Technical analysis shows the campaign deploys 'Essential macOS Stealer' (also linked to Atomic macOS Stealer/AMOS) which targets browser data, Keychains, and over 170 cryptocurrency wallet extensions.
The impact is high for macOS environments, as the malware explicitly steals validated system passwords via fake prompts and clears TCC privacy settings to regain access to sensitive folders. The rapid rotation of infostealer file hashes—changing as frequently as every 15 minutes—renders traditional hash-based blocking ineffective, necessitating behavior-based detection focused on the C2 protocol and blockchain queries.