Phexia macOS Backdoor Uses ClickFix Lures and Polygon Blockchain (EtherHiding) to Hide C2 Infrastructure
Phexia is a modular macOS backdoor and infostealer sold to multiple threat actors, delivered through ClickFix social-engineering lures on typosquatted domains and fake shopping listings that trick victims into pasting a command into Terminal. Since May 2026, newer builds retrieve their command-and-control address from a Polygon smart contract, a technique called EtherHiding, making takedown far harder than with traditional domains. WithSecure researchers documented the infection chain, infrastructure rotation via the contract's setServerURL() function, and a range of theft and cryptomining payloads deployed by the operators.
Detalhes técnicos
The lure copies a shell command (often named update.sh, script.sh or clear-cache.sh) to the clipboard, which the victim pipes into bash. This launches an AppleScript dropper via osascript that writes a LaunchAgent with KeepAlive and RunAtLoad set, embedding a base64-encoded loader. Early builds (June–mid-September) used labels like com.<16 letters>; October builds switched to com.Apple.<16 letters>, a capitalized namespace that mimics but deviates from Apple's genuine lowercase convention. The loader has no hardcoded C2: it issues an eth_call to Polygon contract 0xA3a6…C2A0 using selector 0x2686ecea (getServerURL()) through public RPC endpoints, decodes the returned hostname, and requests a path called bmodule, piping the response into osascript. A second contract, 0x3445…C960, resolved to dhsbdgs[.]icu in a reinfection seen on 27 October. Contract updates do not instantly redirect existing infections; one endpoint, hf98x4d[.]site, kept polling nearly a month after the contract changed. The backdoor shows a fake System Preferences dialog to capture the login password, validates it with dscl . authonly (leaking it into command-line telemetry), and stores it in ~/.passphrase. Stealer modules harvest browser Safe Storage secrets, cookies, login databases, LastPass and NordPass extension stores, and the login keychain, archiving data with ditto before uploading over HTTPS and, separately, plain HTTP to 62.60.226[.]50 — an IP also hosting a WebSocket remote-shell agent and a fake Ledger Wallet app targeting seed phrases. C2 tasking also deployed XMRig 6.26.0, with the operator switching mining pools from HashVault to SupportXMR and using two wallets between 20–26 October. From 20 October, the backdoor began uploading software inventory data, likely to inform task selection.
Remediação
Because Phexia relies on native Apple utilities and per-build obfuscation, hash-based detection is weak; defenders should hunt for Terminal-spawned curl-to-bash commands, osascript execution from LaunchAgents decoding base64 content, both LaunchAgent label formats, non-browser Polygon JSON-RPC calls, dscl authonly invocations with plaintext passwords, and writes to ~/.passphrase. Responders should remove all LaunchAgents (including older labels), treat historical C2 domains as still potentially live, and reset passwords and rotate credentials, session cookies and wallet secrets. Killing only the osascript process is insufficient since launchd respawns it and duplicate beacon processes can run concurrently.
Linha do tempo
-
Phexia macOS Backdoor Uses ClickFix Lures and Polygon Blockchain (EtherHiding) to Hide C2 Infrastructure
ler a análise desta fonte ocultar
Phexia is a modular macOS backdoor and infostealer sold to multiple threat actors, delivered through ClickFix social-engineering lures on typosquatted domains and fake shopping listings that trick victims into pasting a command into Terminal. Since May 2026, newer builds retrieve their command-and-control address from a Polygon smart contract, a technique called EtherHiding, making takedown far harder than with traditional domains. WithSecure researchers documented the infection chain, infrastructure rotation via the contract's
setServerURL()function, and a range of theft and cryptomining payloads deployed by the operators.Technical Details
The lure copies a shell command (often named
update.sh,script.shorclear-cache.sh) to the clipboard, which the victim pipes intobash. This launches an AppleScript dropper viaosascriptthat writes a LaunchAgent withKeepAliveandRunAtLoadset, embedding a base64-encoded loader. Early builds (June–mid-September) used labels likecom.<16 letters>; October builds switched tocom.Apple.<16 letters>, a capitalized namespace that mimics but deviates from Apple's genuine lowercase convention. The loader has no hardcoded C2: it issues aneth_callto Polygon contract0xA3a6…C2A0using selector0x2686ecea(getServerURL()) through public RPC endpoints, decodes the returned hostname, and requests a path called bmodule, piping the response intoosascript. A second contract,0x3445…C960, resolved to dhsbdgs[.]icu in a reinfection seen on 27 October. Contract updates do not instantly redirect existing infections; one endpoint, hf98x4d[.]site, kept polling nearly a month after the contract changed. The backdoor shows a fake System Preferences dialog to capture the login password, validates it withdscl . authonly(leaking it into command-line telemetry), and stores it in~/.passphrase. Stealer modules harvest browser Safe Storage secrets, cookies, login databases, LastPass and NordPass extension stores, and the login keychain, archiving data withdittobefore uploading over HTTPS and, separately, plain HTTP to 62.60.226[.]50 — an IP also hosting a WebSocket remote-shell agent and a fake Ledger Wallet app targeting seed phrases. C2 tasking also deployed XMRig 6.26.0, with the operator switching mining pools from HashVault to SupportXMR and using two wallets between 20–26 October. From 20 October, the backdoor began uploading software inventory data, likely to inform task selection.Remediation
Because Phexia relies on native Apple utilities and per-build obfuscation, hash-based detection is weak; defenders should hunt for Terminal-spawned curl-to-bash commands, osascript execution from LaunchAgents decoding base64 content, both LaunchAgent label formats, non-browser Polygon JSON-RPC calls,
dscl authonlyinvocations with plaintext passwords, and writes to~/.passphrase. Responders should remove all LaunchAgents (including older labels), treat historical C2 domains as still potentially live, and reset passwords and rotate credentials, session cookies and wallet secrets. Killing only theosascriptprocess is insufficient sincelaunchdrespawns it and duplicate beacon processes can run concurrently.