Phexia macOS Stealer: From a Pasted Command to Polygon C2 and Detection

WithSecure's analysis documents Phexia, a modular macOS backdoor and information stealer delivered via ClickFix paste‑command lures: a curl|bash command launches an AppleScript dropper that installs a LaunchAgent which decodes an embedded loader, uses Polygon smart‑contract eth_call lookups as a dead‑drop resolver for command‑and‑control, deploys stealer/shell/miner modules, exfiltrates browser data, keychains and captured passwords in plaintext, and uploads archives to operator servers; the report includes behavioral detections, IoCs, and step‑by‑step response guidance.