A Mac stealer sold to criminal crews now keeps its address book on a public blockchain. WithSecure published a study on November 4 tracing the family, which it calls Phexia, from a pasted Terminal command through to stolen keychain data and a Monero miner.
Every infection the Finnish lab could follow began the same way. A page offers a fix, and the instruction it hands over runs curl against a shell script piped straight into bash. Script names varied, among them update.sh, and each wave moved to fresh lookalike hosts.
Persistence wearing an Apple label
The script launches an AppleScript dropper that writes a LaunchAgent into the user’s own Library folder with KeepAlive set, so launchd restarts the loader whenever it dies. October builds used com.Apple. plus sixteen random lowercase letters, close enough to pass a glance and wrong enough to spot, since Apple’s labels run entirely lowercase. No readable loader sits on disk; the plist carries it as Base64 text decoded into osascript.
A pointer nobody can seize
Since May the malware fetches its server from a Polygon smart contract, a trick called EtherHiding. The loader queries public nodes for the current address, so one transaction relocates command infrastructure and no domain takedown breaks the chain.
The backdoor then waits. A dscl check validates the login password through a fake System Preferences prompt that keeps asking until the right one arrives, and stores it in a hidden .passphrase file. Browser safe-storage keys, password-manager stores, the keychain and Safari cookies follow, sent over plain HTTP.
Reinfection does not clean up. WithSecure found two builds on one Mac contacting separate servers, the older still taking orders twenty minutes later, so defenders should inventory every LaunchAgent. Hashes help little; detection belongs in behaviour, from Terminal spawning osascript to scripts reaching for Polygon.
