Phexia Stealer — macOS ClickFix Infostealer + RAT

Phexia Stealer is a macOS infostealer-plus-RAT distributed through ClickFix social engineering: a fraudulent bot-verification / fake-CAPTCHA page silently places a downloader command on the victim's clipboard and instructs them to paste and run it in Terminal. Reporting on the broader June 2026 ClickFix wave pairs Phexia with HellsUchecker, an EtherHiding-delivered backdoor that executes files retrieved from C2 and reports results back.

Signature chain: the pasted command runs a bash one-liner that uses dig to fetch a DNS TXT record (a dead-drop resolver) from a public resolver, pipes the result to curl, and executes it as JavaScript via osascript (JXA). This fileless bootstrap lets the operator change behavior by editing a DNS record — nothing on disk changes. The implant then installs a LaunchAgent (e.g. ~/Library/LaunchAgents/com.components.<rand>.plist with a matching script under ~/Library/), loads it with launchctl load (RunAtLoad), and polls C2 every 60 seconds for new osascript tasks.

Capabilities: host fingerprinting (ioreg … IOPlatformExpertDevice, whoami/id -un), local password harvesting via a spoofed "System Preferences" dialog validated with dscl . authonly and stored to ~/.passphrase, tccutil reset All to coax privacy prompts, and theft of browser data, extensions, cookies/history, crypto wallets, password managers, Keychain, and Telegram session data. C2 domains are rotated and discovered via a Telegram bot; infrastructure is hosted on vdsina VPS.

Defender priority: The strongest, version-independent detection is the ClickFix bootstrap shape — Terminal/bash spawning dig (TXT lookup) and curl piped into osascript — and the LaunchAgent + 60-second osascript polling that follows. Pair behavioral hunts (Q1–Q4) with an atomic sweep for the published C2 domains/IP (Q5). Falcon for macOS gives full process/network/DNS visibility here, so coverage is good.

Provenance note: every atomic IOC in §4/§10 (C2 domains x2db.cx, a5db.ch, a6b6.biz, kfcnevkusno.one, goldenticketsshop.com; IP 146.103.98.59; Telegram bot t.me/neverfakebot; LaunchAgent path pattern) is taken from the cited Cookie Engineer / Netskope research — none are fabricated. The LaunchAgent label string is sample-specific (random per campaign) — match on the com.components.* / ~/Library/ pattern, not the exact characters.

Hunt hypotheses

• H1: A macOS host runs the ClickFix bootstrap — bash/Terminal spawning dig (TXT lookup) and/or curl piped into osascript/osacompile.
• H2: A new LaunchAgent plist appears under ~/Library/LaunchAgents/ (pattern com.components.* / com.launch.*) and is loaded via launchctl load with a script body under ~/Library/.
• H3: Credential-access tradecraft fires — dscl . authonly, osascript dialog spoofing "System Preferences", tccutil reset All, writes to ~/.passphrase.
• H4: An osascript/curl process beacons on a ~60-second cadence to rotating domains (dead-drop / Telegram-sourced C2).
• H5: Any host resolves or connects to the published Phexia C2 domains or IP 146.103.98.59.

Attack chain

Atomic indicators below are from cited research (Cookie Engineer / Netskope). C2 domains rotate — treat the list as a seed and pivot on the dead-drop / Telegram-sourced infrastructure. Validate before blocking shared hosting.

Affected: macOS endpoints (Intel & Apple Silicon) where a user can be socially engineered into pasting a command into Terminal. No vulnerability is exploited — delivery is 100% social engineering, so any current macOS version is in scope. Falcon for macOS provides process, file, network, and DNS telemetry for the full chain.

macOS-native checks that complement the Falcon CQL in §8 — useful for live triage on a suspect Mac (run with care, read-only first).

Persistence & artifacts (macOS shell)

# Suspicious LaunchAgents (Phexia pattern: com.components.* / random label)
ls -la ~/Library/LaunchAgents/ /Library/LaunchAgents/
grep -rEl "osascript|curl|base64|dig .*TXT" ~/Library/LaunchAgents/ 2>/dev/null
# Harvested password store written by the implant
ls -la ~/.passphrase 2>/dev/null
# Loaded agents referencing the home dir
launchctl list | grep -Ei "components|launch\."

Unified log — bootstrap & beacon (macOS)

# dig TXT dead-drop + osascript execution in the last day
log show --last 1d --predicate 'process == "dig" OR process == "osascript" OR process == "curl"' 2>/dev/null \
  | grep -Ei "TXT|api.php|get.php|osascript"
# tccutil reset abuse (privacy-prompt coaxing)
log show --last 1d --predicate 'process == "tccutil"' 2>/dev/null

Treat a LaunchAgent that shells out to osascript/curl, plus the presence of ~/.passphrase, as confirmed Phexia infection — proceed to §14 containment and capture the plist + script before removal.

// HUNT: Phexia ClickFix bootstrap — dig TXT dead-drop + curl-to-osascript (macOS)
// MITRE: T1059.002, T1071.004, T1204.004 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: rare; some admin tooling pipes curl output — review CommandLine
// TUNING: keep ParentBaseFileName scoped to shells/Terminal; widen if launched by an app bundle
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/(dig\s+.*\s+txt|dig\s+@?[\d.]+.*txt|curl\s.{0,160}(osascript|osacompile)|osascript\s.{0,120}(do shell script|IOPlatformExpertDevice))/i
| groupBy([ComputerName, ParentBaseFileName, ImageFileName, CommandLine], function=([count(aid, as=hits), collect([UserName])]))
| sort(hits, order=desc)

// HUNT: Phexia LaunchAgent persistence write (macOS)
// MITRE: T1543.001 | CONF: high  FP: medium  COST: low | REQUIRES: file-write telemetry (macOS)
// FALSE POSITIVES: legit app LaunchAgents; allowlist signed vendor bundle IDs
// TUNING: prioritize ContextBaseFileName in (bash, sh, osascript, curl); exclude known good labels
#event_simpleName=/NewExecutableWritten|NewScriptWritten|MachOFileWritten/
| event_platform=Mac
| TargetFileName=/\/Library\/LaunchAgents\/.*\.plist$/i
| TargetFileName=/(com\.components\.|com\.launch\.)/i
| groupBy([ComputerName, ContextBaseFileName, TargetFileName], function=([count(aid, as=writes), collect([UserName])]))
| sort(writes, order=desc)

// HUNT: Phexia credential access — dscl authonly / spoofed password dialog / tccutil reset (macOS)
// MITRE: T1056.002, T1555, T1548 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: rare; some MDM tooling uses dscl — allowlist by ImageFileName/parent
// TUNING: combine with Q1/Q2 host hits to confirm full chain
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| CommandLine=/(dscl\s+\.\s+(-)?authonly|tccutil\s+reset\s+All|osascript.{0,120}(System Preferences|password|passphrase)|ioreg\s+-rd1\s+-c\s+IOPlatformExpertDevice)/i
| groupBy([ComputerName, ParentBaseFileName, ImageFileName, CommandLine], function=([count(aid, as=hits), collect([UserName])]))
| sort(hits, order=desc)

// HUNT: Phexia 60s C2 polling loop — recurring curl/osascript (macOS)
// MITRE: T1071.001, T1041 | CONF: medium  FP: medium  COST: medium | REQUIRES: ProcessRollup2 (macOS)
// FALSE POSITIVES: legit polling daemons; correlate with persistence + bootstrap hits
// TUNING: adjust the execs threshold (default >= 10/host/hour) to your baseline
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Mac
| ImageFileName=/\/(curl|osascript)$/i
| CommandLine=/(api\.php|get\.php|txid=|connect&username=|--connect-timeout\s+5)/i
| groupBy([ComputerName, ImageFileName], function=([count(aid, as=execs), collect([CommandLine])]))
| execs>=10
| sort(execs, order=desc)

// HUNT: Phexia atomic C2 sweep — domains + vdsina IP (macOS/all)
// MITRE: T1071 | CONF: high  FP: low  COST: low | REQUIRES: DnsRequest / NetworkConnectIP4
// FALSE POSITIVES: low; IP is shared VPS — confirm before broad block
// TUNING: extend the domain list as new dead-drop / Telegram-sourced domains surface
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| DomainName=/(goldenticketsshop\.com|x2db\.cx|a5db\.ch|a6b6\.biz|kfcnevkusno\.one)$/i OR RemoteAddressIP4=/^146\.103\.98\.59$/
| groupBy([ComputerName, DomainName, RemoteAddressIP4], function=([count(aid, as=hits), collect([ContextBaseFileName])]))
| sort(hits, order=desc)

Field-name note: queries use standard Falcon fields (#event_simpleName, event_platform, ParentBaseFileName, ImageFileName, CommandLine, TargetFileName, ContextBaseFileName, DomainName, RemoteAddressIP4, ComputerName, aid, UserName). Confirm the macOS file-write #event_simpleName values available in your tenant for Q2 (the path/label filters carry the precision).

Phexia uses only built-in macOS binaries (living-off-the-land), so scope IOAs by behavioral chaining (parent shell → curl/osascript → persistence/credential step) rather than by file hash. Start in Detect; promote the credential-dialog IOA to Prevent first.

Atomic indicators are from cited research and ready to import; the IP is shared VPS infrastructure — set it to detect/validate rather than hard block. Domains rotate; keep the list updated from the dead-drop / Telegram source.

type,value,action,severity,expiration,description,tags
domain,goldenticketsshop.com,block,high,2026-09-26,Phexia macOS C2 / dead-drop,campaign:phexia-clickfix
domain,x2db.cx,block,high,2026-09-26,Phexia macOS rotating C2,campaign:phexia-clickfix
domain,a5db.ch,block,high,2026-09-26,Phexia macOS rotating C2,campaign:phexia-clickfix
domain,a6b6.biz,block,high,2026-09-26,Phexia macOS rotating C2,campaign:phexia-clickfix
domain,kfcnevkusno.one,block,high,2026-09-26,Phexia macOS rotating C2,campaign:phexia-clickfix
ipv4,146.103.98.59,detect,medium,2026-09-26,Phexia vdsina VPS C2 (validate-shared),campaign:phexia-clickfix

PERSIST  ~/Library/LaunchAgents/com.components.*.plist   -> LaunchAgent (label com.launch.*)
SCRIPT   ~/Library/<campaign-id>                          -> second-stage osascript body
CREDS    ~/.passphrase                                   -> harvested local password
C2URI    /api.php?check  /get.php?txid=  /api.php?connect&username=
TG       t.me/neverfakebot                               -> operator domain-distribution bot

BEHAVIOR: shell -> dig TXT dead-drop -> curl piped to osascript          -> detect (Q1)
BEHAVIOR: LaunchAgent com.components.* written under ~/Library           -> detect (Q2)
BEHAVIOR: dscl . authonly + spoofed System Preferences dialog            -> detect (Q3)
BEHAVIOR: tccutil reset All by a shell/osascript descendant              -> detect (Q3)
BEHAVIOR: recurring curl/osascript to /api.php /get.php (~60s)            -> hunt   (Q4)
BEHAVIOR: resolve/connect to published Phexia domains or 146.103.98.59   -> block  (Q5)

CHECK  ls -la ~/Library/LaunchAgents/ | grep -Ei "components|launch\."
CHECK  test -f ~/.passphrase && echo "PHEXIA passphrase store present"
CHECK  launchctl list | grep -Ei "components|launch\."
LOG    log show --last 1d --predicate 'process == "osascript"' | grep -Ei "api.php|txid"
KILL   (after capture) launchctl unload ~/Library/LaunchAgents/com.components.*.plist

1 · Sweep Macs for Phexia persistence (Falcon RTR / MDM script, read-only)

#!/bin/bash
# Run per-user context. Read-only enumeration — capture before remediation.
for ua in /Users/*; do
  la="$ua/Library/LaunchAgents"
  [ -d "$la" ] && grep -rEl "osascript|curl|base64|dig .*[Tt][Xx][Tt]" "$la" 2>/dev/null
  [ -f "$ua/.passphrase" ] && echo "PHEXIA passphrase store: $ua/.passphrase"
done

2 · Remove persistence after evidence capture

# Capture first (copy plist + script to evidence), THEN unload & remove:
plist=~/Library/LaunchAgents/com.components.<rand>.plist
launchctl unload "$plist" 2>/dev/null
# move (do not delete) to quarantine for analysis:
mkdir -p ~/phexia-quarantine && mv "$plist" ~/phexia-quarantine/ 2>/dev/null
rm -f ~/.passphrase 2>/dev/null

3 · Block C2 at the network edge

# DNS/proxy denylist (import via your control plane):
goldenticketsshop.com
x2db.cx
a5db.ch
a6b6.biz
kfcnevkusno.one
# Detect-and-validate (shared VPS): 146.103.98.59

Because Phexia rotates domains via a Telegram bot, treat the domain list as a moving target — block what's known, but rely on the §8 behavioral queries to catch new infrastructure.

Coverage note: collection of specific browser/wallet/Keychain files is read-activity that is noisy in isolation — this pack catches it via the surrounding chain (bootstrap → persistence → credential dialog → beacon) rather than alerting on every file read. C2 exfil over HTTPS is opaque, so detection leans on destination + cadence (Q4/Q5). Falcon-for-macOS coverage of process/file/DNS makes the early chain high-fidelity.