url
https://update.apex-arena-router.com/payload.enc
discovered 2026-07-22
AES-256-CBC encrypted macOS stealer payload fetched by loader.sh, decrypted in memory (key = upload token) and piped to osascript. Never written to disk as a separate file.
