Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Phexia

Also known as:Phexia StealerPhexia macOS Stealer

What is the Phexia infostealer, and what data does it steal?

Phexia (also known as Phexia Stealer and Phexia macOS Stealer) is an information-stealing malware family. Phexia targets browser credentials, cryptocurrency wallets, Telegram session tokens, macOS login credentials (captured at the panel prompt), Chromium browser extension data and local extension settings, macOS Keychain (`/Library/Keychains/login.keychain-db`) and Notes.app passwords and small files in `~/Downloads`. As of 11/10/2026, CyStack's research records 1 variant, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

Phexia is a macOS info-stealer that has been operating in private distribution since April 2024 per a published developer interview. The payload is implemented in osascript (AppleScript) and the developer states it shares roughly 85% of its code with the Mac.c stealer module, but it is marketed and tracked as a separate product with its own self-identification banner and its own customer base (around 20 active operators per the developer at the time of the interview).

The on-disk UserInformation.txt opens with the literal Phexia macOS Stealer banner, then a flat identity block (Build: / Username: / Password: / IP Address:), then the verbatim system_profiler output under Software: / Hardware: / Graphics/Displays: section headers. The Build: tag is a per-customer affiliate identifier set at build time. Captured macOS login credentials ship in the Username: / Password: pair at the top of the file.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`b2acb22...`	1	High

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1Build: <value>2Username: <value>3Password: <value>4IP Address: <value>5 6Software:7 8    System Software Overview:9 10      System Version: <value>11      Kernel Version: <value>12      Boot Volume: <value>13      Boot Mode: <value>14      Computer Name: <value>15      User Name: <value>16      Secure Virtual Memory: <value>17      System Integrity Protection: <value>18      Time since boot: <value>19 20Hardware:21 22    Hardware Overview:23 24      Model Name: <value>25      Model Identifier: <value>26      Model Number: <value>27      Chip: <value>28      Total Number of Cores: <value>29      Memory: <value>30      System Firmware Version: <value>31      OS Loader Version: <value>32      Serial Number (system): <value>33      Hardware UUID: <value>34      Provisioning UDID: <value>35      Activation Lock Status: <value>36 37Graphics/Displays:38 39    Apple M2 Pro:40 41      Chipset Model: <value>42      Type: <value>43      Bus: <value>44      Total Number of Cores: <value>45      Vendor: <value>46      Metal Support: <value>47      Displays:48        Color LCD:49          Display Type: <value>50          Resolution: <value>51          Main Display: <value>52          Mirror: <value>53          Online: <value>54          Automatically Adjust Brightness: <value>55          Connection Type: <value>

Phexia Stealer Malware Analysis: Targets & TTPs