A macOS malware called Phexia is spreading through deceptive web pages that trick users into pasting commands into Terminal. Once the command runs, the malware silently installs itself, steals login credentials, and copies browser data, keychain files, and password-manager extension information. Securely, we advise monitoring behavior instead.

Indicators of compromise (IoCs): - Polygon contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0, used with selector 0x2686ecea, June to October 2026 - Polygon contract 0x3445fB8Df432320251f611e691fe6B0C6664C960, used by a build installed October 27; resolved to dhsbdgs[. ]icu - Polygon RPC endpoints: polygon.drpc[. ]org, polygon.publicnode[.

]com, polygon-mainnet.gateway.tatum[. ]io, tenderly.rpc.polygon[. ]community Legitimate services; suspicious only when contacted by osascript - C2 domains: hf98x4d[. ]site, apdhlhs3[.

]xyz, j9af4sr[. ]guru, 67sixcebeh[. ]surf, stv4ec5[. ]shop, vg5sgxv[.

]lol, d9mjs[. ]sbs, first seen June to September 2026 - C2 domains: jse8x92s[. ]me, couhe79[. ]xyz, xzttyt[.

]xyz, secdarvin2026[. ]icu, oreshnik[. ]top, svo-zv[. ]pro, dhsbdgs[.

]icu, first seen September to October 2026 - Delivery hosts: hackersteersman[. ]digital, coeuzgoq.bahisbiz[. ]com, kefavkd.nextbahis[. ]sex, d9j.everunningshoes[.

]com, nox.usa-synadentix[. ]com, zwa8.meritbethizligir[. ]com, 355uz90z.bolnhurstrally[. ]site, 7ulk.irvinaurus[.

]fit, host the first-stage scripts - Script names: update.sh, script.sh, clear-cache.sh, Terminal.sh, first-stage scripts - Upload server: 62.60.226[. ]50, Plain HTTP upload.php - Mining pools: pool.hashvault[. ]sh:443, pool.supportxmr[. ]com:3333, XMRig 6.26.0 - Monero wallet: 4ApYm7Cp1QKHYd34eWHTLMR9JwGxEiPkP5GYNbD7UaGUBsAE31oRt8zbCiz7yV6BbHa5mZUGYxeMRbihPXxo9o3vNWJxx2L, Miner wallet - Monero wallet: 82hSZSZNcbCdWd3ESkMDnC5cegaJnFhcG8PUBkMPof5mEdMDCF8cLcE1QuW4h82ggwi4qtfnRwMEgZPKQEnogkvmLFuRLFv, Miner wallet - Host artifacts: ~/Library/LaunchAgents/com.<16 letters>.plist and com.Apple.<16 letters>.plist, Persistence - Host artifacts: ~/.passphrase, ~/.txid, ~/tempFolderC/, /tmp/.zip, /tmp/updstat.txt, /tmp/rigupdater/, /tmp/applecomlistupdate/, Password, build ID, staging, and miner folders - Note: IP addresses and domains are intentionally Qdefanged (e.g., [.])

to prevent accidental resolution or hyperlinking.