Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware

Phexia spreads by convincing Mac users to manually paste malicious commands into Terminal — a technique called ClickFix that bypasses most traditional security controls because the user themselves executes the payload. Once installed, the malware harvests login credentials, browser data, keychain files, and password manager extensions, giving attackers broad access to a victim's digital life. The use of Polygon blockchain smart contracts to obscure the command-and-control server makes detection and takedown significantly harder. This attack succeeds entirely because users are not trained to recognize that pasting commands into a terminal is equivalent to running arbitrary malware, and because macOS environments often lack endpoint monitoring controls. The malware's modular design and criminal marketplace availability signals a scalable threat with a growing victim pool.