https://arena.apexfdn.xyz/api/copilot/mcp

Hosted remote-MCP endpoint reached with a Bearer token. No-install infection vector that sends tokens to attacker infrastructure without any package install.