Phexia stealer staging in /tmp hex dirs and tempFolderC archived to hex zip

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects behavior associated with the Phexia macOS stealer, which stages browser, extension, and Safari cookie data into temporary directories before compressing them into a zip archive.