Analysis of Phexia Modular macOS Backdoor and Infostealer

Phexia is an evolving macOS malware family that has gained prominence since early 2026, primarily distributed through ClickFix-style social engineering campaigns. The malware is notable for its 'EtherHiding' technique, which abuses smart contracts on the Polygon blockchain to resolve command-and-control (C2) addresses. This method allows threat actors to update infrastructure dynamically without altering the malware's binary, complicating traditional takedown efforts.

The attack chain typically begins with a user-executed Terminal command, leading to AppleScript-based dropper execution and persistence via LaunchAgents. Once established, Phexia functions as both a credential stealer—targeting browsers, keychains, and cryptocurrency wallets—and a delivery mechanism for secondary payloads such as the XMRig cryptominer. The malware demonstrates high operational flexibility, with some infections maintaining multiple concurrent builds communicating with separate infrastructure.

For organizations, Phexia represents a significant risk to identity security. It captures plaintext login passwords via 'dscl' and exfiltrates session cookies and keychain material that can be used to bypass MFA on corporate SaaS applications. The increasing adoption of Phexia by multiple threat actors indicates a maturing macOS commodity malware ecosystem that requires robust behavioral detection strategies beyond simple file hashing.