[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPyftBetAeTt3G4Z05474_iYz5ao8GzwFzk8syD1GAFk":3},{"article":4,"iocs":48,"watch_terms":59,"solutions":60,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"3f22df83-bb43-4b6b-946d-4a564bb9ac3f","Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware","hackers-trick-mac-users-into-running-terminal-commands-that-install-phexia-passw-f21851","A macOS malware family called Phexia is spreading through fake web pages that talk Mac users into pasting a command into Terminal. Once the command runs, the malware quietly settles on the Mac, steals the login password, and copies browser data, keychain files, and password-manager extension data. The trick is known as ClickFix. A page […] The post Hackers Trick Mac Users Into Running Terminal Commands That Install Phexia Password-Stealing Malware appeared first on Cyber Security News.","Phexia, a modular backdoor and information stealer targeting macOS, is spreading through ClickFix social engineering attacks that trick users into pasting malicious commands into Terminal. The malware steals login passwords, browser data, keychain files, and password manager extensions, then uses Polygon blockchain smart contracts to hide its command-and-control server. WithSecure identified a growing number of infections since early 2026, indicating the malware is being sold to multiple criminal groups.","Phexia macOS malware spreads via ClickFix social engineering, stealing passwords and browser data.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-trick-mac-users\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Trick-Mac-Users-Into-Running-Terminal-Commands-That-Install-Phexia-Password-Stealing-Malware.webp","2026-11-05T08:31:45+00:00","2026-11-05T09:00:34.518348+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Phexia operators","threat_actor",{"name":21,"type":22},"ClickFix social engineering","technology",{"name":24,"type":22},"EtherHiding",{"name":26,"type":22},"Polygon blockchain",{"name":28,"type":29},"WithSecure","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[49,53,56],{"type":50,"value":51,"context":52},"ip","62.60.226.50","Secondary C2 server receiving stolen data over HTTP",{"type":34,"value":54,"context":55},"Phexia","macOS modular backdoor and information stealer active since late 2025",{"type":34,"value":57,"context":58},"XMRig","Monero miner installed by Phexia operators",[28],{"controls":61,"vendors":145},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":92,"name":93,"problem":94,"products":95},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"slug":121,"name":122,"problem":123,"products":124},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[125,132,139],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":129,"url":130,"description":131},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":121,"product_name":136,"url":137,"description":138},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":140,"product_name":141,"url":143,"description":144},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[146],{"slug":147,"name":28,"logo_path":148,"roles":149},"withsecure","\u002Fvendor-logos\u002Fwithsecure.png",[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":163},"clickfix-social-engineering-delivers-phexia-macos-infostealer-via-terminal-trick","ClickFix Social Engineering Delivers Phexia macOS Infostealer via Terminal Trick","Phexia spreads by convincing Mac users to manually paste malicious commands into Terminal — a technique called ClickFix that bypasses most traditional security controls because the user themselves executes the payload. Once installed, the malware harvests login credentials, browser data, keychain files, and password manager extensions, giving attackers broad access to a victim's digital life. The use of Polygon blockchain smart contracts to obscure the command-and-control server makes detection and takedown significantly harder. This attack succeeds entirely because users are not trained to recognize that pasting commands into a terminal is equivalent to running arbitrary malware, and because macOS environments often lack endpoint monitoring controls. The malware's modular design and criminal marketplace availability signals a scalable threat with a growing victim pool.",[156,157,158,159,160,161,162],"CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","GDPR Article 32",{"GDPR Article 32":164,"MITRE ATT&CK T1566: Phishing":165,"NIST SP 800-53 SI-2: Flaw Remediation":166,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":167,"CIS Control 17: Incident Response Management":168,"CIS Control 14: Security Awareness and Skills Training":169,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":170},"Phexia exfiltrates browser credentials and personal keychain data, constituting a personal data breach; Article 32 requires organizations to implement technical measures — including endpoint controls and monitoring — to prevent unauthorized access to such data.","The ClickFix delivery mechanism is a form of social engineering phishing where victims are manipulated into self-executing malware via Terminal, matching the user-execution sub-techniques documented under T1566.","Maintaining current macOS versions and applying security updates promptly reduces the available attack surface that modular malware like Phexia can exploit once it gains a foothold.","Ensuring staff are competent to recognise social engineering tactics — including being told to paste commands into a terminal — is a direct organizational control that would have interrupted this attack chain.","The growing infection count since early 2026 suggests victims lack the detection and response playbooks needed to identify and contain Phexia infections before significant credential theft occurs.","Phexia relies entirely on deceiving users into running commands themselves; a structured awareness program teaching users to recognize ClickFix-style social engineering would directly prevent execution.","Phexia steals keychain files and password manager data, meaning strong identity controls such as hardware-backed MFA and privileged access management would limit the blast radius of stolen credentials."]