malware
npm
@copilot-mcp/apex
discovered 2026-07-22Postinstall dropper that installs a macOS AMOS-family infostealer. Byte-identical re-publish of @apexfdn/apex under a new scope about 11 hours after npm removed the original. install.cjs downloads a 120-150MB platform binary (repackaged can1357/oh-my-pi fork) from Apex-Foundation/copilot pinned to release tag v1.0.0; macOS branch runs loader.sh (curl|zsh / osascript) which AES-256-CBC decrypts payload.enc in memory and pipes it to osascript. 20+ versions (1.0.0-1.0.22+) shipped in ~8h on 2026-07-22 A/B-testing the macOS launcher; removed by npm same day.
Threat types
credential_stealer data_exfiltration c2_agent persistence
Malicious versions
- 1.0.0
- 1.0.19
- 1.0.21
- 1.0.22
Campaigns
Indicators
- domain update.apex-arena-router.comcommunicates-with
- url https://update.apex-arena-router.com/payload.enccommunicates-with
- ipv4 172.93.185.150communicates-with
- github_repo Apex-Foundation/copilotcommunicates-with
- file_path /tmp/osalogging.zipdrops
- file_path ~/Library/LaunchAgents/com.system.notifications.agent.plistdrops
- file_path ~/Library/Application Support/System/System Notifications.appdrops
- file_path /tmp/sync<random>/drops
- sha1 233f90180b529aa32911901e5222e9ed9c3cd24cindicates
- sha1 3b9a880ae4e1c5b7bbd68e118a1c3c8b592f7bfbindicates
- sha256 ecd1113fae1ede9869afd9d1af612bab7f1a2054e5c45a346e18c107c22b9164indicates
Techniques
- ttp T1059.002 Command and Scripting Interpreter: AppleScriptuses
- ttp T1059.004 Command and Scripting Interpreter: Unix Shelluses
- ttp T1056.002 Input Capture: GUI Input Captureuses
- ttp T1555.001 Credentials from Password Stores: Keychainuses
- ttp T1552.001 Unsecured Credentials: Credentials In Filesuses
- ttp T1539 Steal Web Session Cookieuses
- ttp T1543.001 Create or Modify System Process: Launch Agentuses
- ttp T1071.001 Application Layer Protocol: Web Protocolsuses
- ttp T1041 Exfiltration Over C2 Channeluses
- ttp T1027 Obfuscated Files or Informationuses
- ttp T1036 Masqueradinguses
- ttp T1082 System Information Discoveryuses
- ttp T1119 Automated Collectionuses
