TLDR Tech / InfoSec
Malware Insights: macOS Phexia Campaign (6 minute read)
The Phexia Campaign, likely linked to APT28, deploys a four-stage macOS attack chain initiated via a ClickFix prompt that tricks users into pasting a base64-obfuscated osascript payload into Terminal, establishing LaunchAgent persistence at ~/Library/LaunchAgents/com.components.campaign-id.plist and polling a Telegram bot for live C2 domain updates. The implant uses tccutil reset All to clear TCC permissions and resurface permission dialogs, masquerades a credential-harvesting dialog as System Preferences with 150 retry loops to capture the macOS user password, then, every 60 seconds, pulls and executes a Phexia Stealer osascript payload targeting all crypto wallets, browsers, Keychain, and Telegram auth data. Defenders should alert on launchctl load activity writing to ~/Library/LaunchAgents, monitor for tccutil reset All execution, block vdsina[.]com-hosted domains at the DNS layer, and treat any Terminal paste prompt from a website as an immediate IOC.
Read the full story