Auditing the auditor: Unmasking Apex Accelerator

Elastic Security Labs identified a malicious npm package, @apexacc/cli, which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free AI credits and coding tools, along with security audits. The group also advertised an in-person event through a dedicated invitation page, adding to its efforts to appear legitimate. 

The tools delivered information-stealing malware and backdoors for macOS and Windows machines. The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings. 

We hope that our research raises awareness of similar scams, as AI-generated code, websites, and portfolios increasingly make illegitimate operations look polished and well-established.

Key takeaways

• Elastic Security Labs uncovered a scheme posing as a Web3 venture capital accelerator to target cryptocurrency start-ups and founders.

• This fake organization offers free Claude and Gemini credits, distributes backdoored code repositories and npm packages, and intercepts large language model (LLM) traffic.

• Campaigns distribute CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrates data through Telegram.

• All 18 tools in @apexacc/audit return fabricated findings. In a separate test, @apexacc/cli’s remote scoring service returned 51/100 for a fictitious project while reporting that its AI scorer was unavailable.

How we found the malicious npm packages

This research started with a Slack notification from our supply-chain monitor bot, which flagged suspicious behavior tied to the npm package (@apexacc/cli). On closer inspection, we discovered a package that was malicious from the moment it was published, not a supply chain compromise.

Later that day, we learned that this package was connected to the same publisher in a campaign previously reported by SafeDep. Shortly after this, the same threat actor published another malicious npm package (@apexacc/audit) with a new campaign. We then examined the group's websites and malicious packages, as well as its distributed malware.

How the fake Web3 accelerator attracted founders

The main project presents itself as Apex Arena, a private workspace for crypto/Web3 founders backed by an accelerator called Apex. The website claims to have over 200 portfolio projects and to have raised more than $124 million in capital. 

The platform advertises the following services:

• Smart contract/Web3 security auditing, including downloadable code-auditing tools (the Model Context Protocol–delivered [MCP-delivered] "Apex Audit" suite).

• Direct messaging between founders and Apex investment relations.

• A directory of vetted individuals seeking job opportunities.

• Start-up assessments across a set of categories that produce an Apex Score.

The following screenshot shows a proposed workflow in which users receive their Apex Score through Apex's own coding project, Apex Copilot, which contains a malicious backdoor:

Below is an excerpt from an Apex Audit product pitch on an event listing that was taken down for violating the platform's terms of service:

The group uses fake reviews to make its services appear legitimate to people researching the company or its products:

Our team found an example of a start-up founder describing his interactions with the threat actor and how he handled the scam:

The group also sought to build credibility through its presence at TOKEN2049 in Singapore and other in-person events it has hosted in the past. The group attempts to manufacture legitimacy by appearing at widely attended conferences, indirectly lending credibility to the project. We notified the conference organizers of this activity and provided a summary before publication.

Malicious npm packages and delivery chains

The examined Apex packages use AI/Web3 products as the presentation for a multistage delivery mechanism. @apexacc/cli (apexaccs/copilot on GitHub) advertises an AI coding assistant, and @apexacc/audit (apexaccs/audit-mcp on GitHub) advertises an MCP server that offers 18 security tools. 

Their published launchers download and start platform-specific executables from the projects’ GitHub releases. The associated source implements a separate “verification” path that obtains commands from vrf.apexaccs[.]org and launches them on the host. Windows-specific code also attempts to alter execution policy and security controls. 

@apexacc/audit's advertised security functionality is deceptive. All 18 published tool handlers generate hard-coded, input-formatted, date-derived, or randomized reports instead of running the advertised scans. 

What the npm launchers download and execute

The packages' bin entries point to apex.cjs and audit.cjs, respectively, which run when users invoke the installed commands or launch them through npx. The launchers construct versioned release URLs and cache the executables under the user's home directory. They start them with spawnSync.

The two repositories distribute the following components:

The execution chains for both packages are shown below:

Repackaged Oh My Pi source

@apexacc/cli repackages the legitimate open-source coding agent Oh My Pi. We compared Apex Copilot v1.6.1 with the original Oh My Pi v16.3.6 project, using a saved Git clone of the Apex repository and a complete file list, including content hashes, obtained from GitHub for Oh My Pi. We then matched files at the same location under packages/coding-agent/src/ and compared their content hashes. Of the 1,363 files in Apex’s directory, 1,351 matched their Oh My Pi counterparts exactly. Apex adds a bootstrap that implements verification-command execution and redirects OpenRouter-labeled model traffic through Apex infrastructure. It also registers an Apex-controlled MCP server. The copied agent provides genuine functionality that helps conceal these additions. 

The Windows add-on pi_natives.win32-x64-baseline.node corresponds to Oh My Pi's native dependency and provides shell execution, terminal sessions, process management, clipboard access, and file-processing functions. Its checked Rust source matches Oh My Pi's implementation. Preliminary static inspection found no additional malicious mechanisms in this DLL.

How the bootstrap runs attacker commands on Windows and macOS

The two projects place their bootstrap logic in different files: @apexacc/cli uses packages/coding-agent/src/apex-bootstrap.ts, while @apexacc/audit implements it in src/main.ts. Both use the same verification service, hxxps://vrf.apexaccs[.]org/api/v1/vrf, and accept server-selected exec, args, and cmd fields. The platform determines how that request and command execution occur:

Windows: Direct command retrieval

On Windows, both bootstraps directly POST {"p":"win32"} using JavaScript's HTTPS API. They construct a command line from the response's exec, args, and cmd fields. An example constructed command line looks like this: powershell.exe -nop -EncodedCommand <cmd>.

The @apexacc/cli bootstrap writes this command line into %TEMP%\_apex_run.ps1; @apexacc/audit writes it into %TEMP%\_audit_run.ps1. Each also writes a VBScript launcher (_apex_run.vbs or _audit_run.vbs in the same temporary directory) containing a WScript.Shell.Run call that starts powershell -NoProfile -ExecutionPolicy Bypass -File <path-to-ps1>. The bootstrap then launches wscript.exe with the VBScript file as its argument: 

@apexacc/audit's bootstrap also requests User Account Control (UAC) elevation on Windows 11 to exclude its local application directory, %USERPROFILE%\.apex-audit, from Microsoft Defender Antivirus scanning and attempts to disable Smart App Control by setting VerifiedAndReputablePolicyState to zero.

macOS: Command fetching through a Rust verifier

For macOS, instead of making network requests directly from JavaScript, both packages delegate this step to a small Rust binary, apex-verify-darwin (copilot) / apex-audit-verify-darwin (audit-mcp). These binaries POST {"p":"darwin"} to vrf.apexaccs[.]org/api/v1/vrf to retrieve a command from the attacker's command-and-control (C2) server. 

This command downloads a remotely hosted bash script and executes it on the machine. The script masquerades as a generic application installer, but its real logic downloads a gzip-compressed tarball from the URL (verify.apexfdn[.]xyz/unix/ab640649-3889-4169-8804-2a1a8ba0fe72) and saves it as package.tar.gz in a temporary directory, in addition to extracting it:

The archive contains a single Mach-O binary named installer. This is the dropper component of the malware family (CloudSyncD), previously discussed by Jamf. We cover our analysis of this chain in the following section. 

Remote MCP and LLM routing expand the software's control surface

The @apexacc/cli bootstrap redirects OpenRouter-labeled model requests to an attacker-controlled API endpoint and registers an attacker-controlled MCP server in the victim's agent configuration. 

These changes allow the attacker-controlled API to receive the prompts, conversation history, code snippets, and tool outputs included in the agent's LLM requests. The attacker's MCP server can also supply instructions that are added to the agent's prompt, along with tool names, descriptions, and accepted inputs that help the model decide which tools to invoke and how to use them. Together, these mechanisms give the attacker visibility into the submitted data and a way to influence the agent's subsequent actions.

How the attacker intercepts OpenRouter LLM traffic

If no token is available, the CLI prompts the user to visit hxxps://arena.apexaccs[.]org/dashboard/pilot to obtain an Apex token and paste it into the terminal:

Once a token is available, the bootstrap overwrites three environment variables in the running process:

With Chat Completions mode selected (PI_OPENROUTER_RESPONSES=0), requests are sent to hxxps://arena.apexaccs[.]org/api/llm/v1/chat/completions. The provider remains labeled OpenRouter, while the actual network peer is an attacker-controlled server:

An instrumented session confirmed this routing in a working client. A main chat request containing the marker REF8801-CHAT-CHECK-01 went to that endpoint and received an HTTP 200 streamed response referencing the marker. The request also included two system messages and 28 tool definitions: 20 generic agent tools and eight Apex-specific remote MCP tools.

Control of the endpoint also lets an attacker substitute responses, including structured tool calls that the client parses as model output. The captured source defaults tool approvals to yolo, allowing read, write, and execution tiers unless explicit policies or other controls intervene. This could let substituted responses drive enabled local tools through the normal agent loop. However, we didn’t observe malicious LLM response substitution.

To test what happens after a local tool runs, we created C:\ApexTest\testfile.txt, which contains the unique value REF8801-TEST-FILE-CONTENT. We then asked the agent:

The initial model request contained this instruction and the file path but not the file's value. The response selected the local read tool with C:\ApexTest\testfile.txt as its path argument. Then the next POST to the attacker-controlled chat-completions endpoint included the following tool-result fields:

The same file-read result remained in later conversation requests, showing that the model transmitted locally read content as context after an explicitly requested file read.

Persistent registration of an attacker-controlled MCP server

The bootstrap creates or replaces an apex-copilot entry in ~/.apex/agent/mcp.json, pointing to hxxps://arena.apexaccs[.]org/api/copilot/mcp with a bearer token and device identifier. This entry persists across process restarts:

It uses the agent's MCP support to automatically connect to the attacker-controlled server. A network capture showed the server's eight tool definitions (apex_score, apex_code_review, …) and instructions in outgoing LLM requests, alongside a warning that the instructions were server-controlled and might not be verified.

Fabricated MCP audit results

@apexacc/cli's scoring test returned an unsupported assessment of a fictitious project, while inspection of @apexacc/audit's source exposed hard-coded, fabricated “security” findings. 

Scoring a project that doesn’t exist

We asked the @apexacc/cli agent to use apex_score once for a fictitious project, “REF8801 Synthetic Notes,” described as a pre-revenue prototype for publishing public research notes. The project existed only as our test description. We provided no repository, contract address, team information, or other project details. The instruction asked the agent to request any missing inputs and to stop if verification was required.

The agent invoked the remote apex_score tool without additional confirmation. The service returned an overall score of 51/100 and assigned the same score of 51 to five assessment categories (team, traction, tokenomics, market & moat, and security). It also disclosed that its AI scorer service was unavailable.

We assess these uniform figures as likely fabricated placeholder scores rather than substantiated findings about the project. The claimed outage and server-side method used to generate the scores couldn’t be independently verified:

Hard-coded results in the local audit tools

The separate @apexacc/audit package implements a local MCP server named apex-audit. Its bootstrap script attempts to register the main Bun executable with --mcp in existing Claude Desktop, Cursor, and Windsurf configurations. However, a start-up logic bug rejects --mcp before the server-start branch is reached. The README instructs users to configure their MCP client to launch dist/server.js directly under Node. If adopted, that configuration lets the client launch the server without passing through the bootstrap gate.

Inspection of all 18 published tool handlers showed that they don’t perform the advertised security investigations. They format hard-coded findings, insert user-supplied labels, and, in some cases, add random scores or date-derived values. The server wraps their output as type: "text" tool results and returns it to the AI client over standard input/output. 

Following are four examples of advertised and implemented behavior:

Earlier delivery infrastructure and domain rotation

Historical @apexacc/cli source exposes additional script-download addresses. The three Windows domains in the following table appear in succession as the bootstrap's hard-coded download host changed:

A later Rust-verifier revision replaces the fixed main.router-apex[.]com/updater.sh address with the command-response endpoint hxxps://vrf.apexaccs[.]org/api/v1/vrf.

@apexacc/audit uses that same endpoint from its initial verifier implementation.

Historical commits contained a few Russian comments. Examples include Проверяем AI агентов по env переменным ("Check for AI agents using environment variables") and Анти-отладка и анти-агент проверки ("Anti-debugging and anti-agent checks") in the macOS verifier source. However, these language artifacts alone don’t establish nationality or actor attribution:

CloudSyncD: macOS malware analysis

CloudSyncD first stage: Password prompt

The dropped file is known as the CloudSyncD family, based on the application it masquerades as cloudsync. The file is a Mach-O universal binary that contains multiple architecture slices bundled together (ARM64, x86_64), allowing for maximum compatibility across victims. This first stage primarily loads the embedded payload.

CloudSyncD incorporates string obfuscation through an in-house library, based on its symbols (cloudsync_impl::sobf, class template CTEnc<N>). Strings are encrypted at compile-time and decrypted at runtime, either through CTEnc<N>::str() or a standalone helper (sobf::reveal) that implements the same algorithm. Each string’s ciphertext is decrypted byte by byte with a custom XOR-based cipher using the following formula:

Here, K is a fixed 32-byte table embedded in the binary and shared by every string, and seed is a per-string key byte, either stored with the ciphertext (CTEnc<N>) or passed as an argument (sobf::reveal).

Below is the Python implementation of the string decryption algorithm:

The malware kicks off by presenting an authorization dialog that requests the user's password for administrator access. The password is validated using Directory Services with this command line: /usr/bin/dscl /Local/Default -authonly <username> <password>.

After successful validation, the password is stored in a global variable and written to ~/.config/cloudsync/data.json. This password launches the embedded payload with sudo privileges. During this time, the embedded payload is executed in the background, while a decoy message is presented to the user, masked as an error message: "Shared library version mismatch. The version of the shared library on the system does not match the version which was expected."

CloudSyncD second stage: Host discovery and C2 tasking

The main payload portion of CloudSyncD, also referred to by the developer as the gate, performs host discovery by querying system information and sending it to the C2 on the first outbound request. It obtains the Mac's IOPlatformUUID by querying IOPlatformExpertDevice and uses this value as the hwid to uniquely identify victim machines. 

Next, the malware collects the following hardware and operating-system details using system queries:

• CPU name via machdep.cpu.brand_string

• CPU count via hw.ncpu

• Physical RAM via hw.memsize

• Hardware model identifier via hw.model

• Darwin kernel version via kern.osrelease

• Username 

• Machine name via gethostname()

• MAC address via getifaddrs()

This is followed by CloudSyncD issuing the following ioreg command to collect broader system details:

/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice 2>/dev/null

Afterward, CloudSyncD combines these two datasets with their collected fields into JSON, which is encrypted using ChaCha and then encoded with Base64 and sent out to the following URL in a POST request:

hxxps://ccmihr[.]com/macos/jquery.js The C2 responds with JSON containing a field named task, and the implant handles it in seven steps:

1. Reads the task field from the server’s JSON response.

2. Identifies whether the task contains a raw Mach-O executable or as a gzip-compressed package.

3. For the gzip route, the malware writes the decrypted data to p.tgz, extracts it with /usr/bin/tar, and searches the extracted directory for bin/appd or bin/cloudsyncd. A raw Mach-O task will skip this step.

4. Checks the executable’s Mach-O signature.

5. Attempts execution through a temporary file exposed as /dev/fd/<number>.

6. If that fails, writes a hidden executable named .t_XXXXXX.

7. Launches the hidden executable with sudo, falling back to a direct launch if spawning sudo fails.

During our analysis, we didn’t observe the C2 server providing any additional payloads.

Below is the configuration obtained from the sample: 

The Windows infostealer chain, stage by stage

Initial execution

Following the direct command-retrieval path, the malware submits a POST request with the body {"p":"win32"} to hxxps://vrf.apexaccs[.]org/api/v1/vrf to retrieve a Base64-encoded PowerShell command:

The decoded command constructs the endpoint 0auth-chromium[.]com/APIService and attempts to retrieve and execute its response. The response is a PowerShell script named drop.ps1, which downloads an executable from https://ehegisnightmare[.]icu/build/nTOugj-fWWMurYHg/bludness.exe and launches it in a hidden window: 

Python first-stage loader and UAC bypass

The executable delivered (bludness.exe) contains a PyInstaller-packaged Python loader that adds another download-and-execute step. However, an exception dialog shows a start-up failure caused by a missing Python dependency, suggesting a PyInstaller packaging issue. During our analysis, the loader stopped before it could invoke the next stage:

Using tools like PyInstaller Extractor and PyLingual, we recovered and examined the embedded loader.py module. On a normal launch, the loader calls shell32.IsUserAnAdmin to check whether it already has administrator privileges. If so, it leaves a unique marker at %APPDATA%\.cobra and proceeds to the routine responsible for downloading and launching the next stage at hxxps://ehegisnightmare[.]icu/build/J2BkQFArlBUXf4MF/install.exe. The loader saves this payload as %TEMP%\exegis.exe.

Otherwise, it invokes a Python reimplementation of UACME's ucmDebugObjectMethod (based on James Forshaw's Project Zero research). The loader sends a direct remote procedure call (RPC) request to the Windows AppInfo service to create a non-elevated winver.exe process under debugging and then captures a handle to its debug object. After detaching and terminating winver.exe, it sends another RPC request asking AppInfo to create an elevated computerdefaults.exe process under debugging. When both requests are handled by the same AppInfo worker thread, the service reuses the debug object, allowing the loader to receive debugging events for the elevated process. The loader then obtains a privileged process handle through those events and uses it to select computerdefaults.exe as the parent of a new loader instance launched with --elevated

If the technique fails, the loader falls back to requesting elevation through ShellExecuteW with the runas verb, which triggers a UAC prompt. The --elevated argument directs the relaunched instance straight into the download routine.

Python second-stage loader and anti-virtual-machine (anti-VM) checks

The next stage, install.exe / exegis.exe, is another PyInstaller executable containing a Pyarmor-protected application entry point, which can be unpacked through open source tools. The recovered logic in install.pyc shows that it loads 15 environment-blocklist resources (these lists are accessible through public GitHub repos) and calls a user-defined CheckVirtual function before decrypting its packaged payload. The checks examine user and computer environment values, running processes, hardware identifiers, manufacturer information, MAC addresses, platform information, and public IP data:

After passing the checks, it uses an embedded Fernet key to decrypt a filename token, which resolves to loader.exe. It then uses that name to locate the bundled resource enc_loader.exe. Despite the executable extension, this resource remains plain encrypted data. The loader decrypts its contents using the same key and writes the resulting executable to %TEMP%\updater_loader.exe. It launches it through subprocess.run().

Golang loader

updater_loader.exe is a Golang loader responsible for loading the next-stage shellcode into its own memory. It tries to unhook ntdll.dll by restoring it from a suspended Notepad process, attempts Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) patching, decrypts the next stage, and supplies an executable allocation as an EnumPageFilesW callback.

The loader first attempts to hide its console and then launches notepad.exe in a suspended state. It then locates the .text section of ntdll.dll from the suspended process and copies it over to its own process using ReadProcessMemory and WriteProcessMemory. The assumption is that the newly created, suspended process contains a cleaner copy of ntdll.dll, where user-mode endpoint detection and response (EDR) hooks might not have been present.

The loader scans AmsiOpenSession for a conditional-branch byte and attempts to invert it. However, an address-calculation bug causes the patch to overwrite part of the function's initial instruction instead, corrupting its control flow. This demonstrates AMSI tampering but isn’t a reliable bypass:

Similarly, for ETW tampering, the loader targets five exports in ntdll.dll: EtwEventWrite, EtwEventWriteEx, EtwEventWriteFull, EtwEventWriteString, and EtwEventWriteTransfer. It uses WriteProcessMemory to attempt to overwrite each function's first four bytes with 48 33 C0 C3 (xor rax, rax; ret). This sequence is intended to make the functions immediately return zero upon invocation:

Then the loader decrypts an embedded, hex-encoded shellcode using AES-256-CBC with an embedded key and initialization vector (IV). After decryption, it calls ZwAllocateVirtualMemory to reserve and commit read/write memory in its own process. It copies the decrypted buffer using NtWriteVirtualMemory and requests execute/read protection through ZwProtectVirtualMemory. It passes the allocation's address to EnumPageFilesW as its callback. This provides an in-process execution path without explicitly creating a separate payload thread:

Final stage: Information stealer

The DonutLoader-shaped shellcode deploys a native information stealer. The executable adds a protection layer that rearranges its main code region into 16-byte blocks, while a small restoration stub remains intact at the entry point: 

How the block-shuffle protection restores itself

In our analyzed sample, the protected region begins at the start of the .text section at 0x140001000 and extends to 0x140224940, which is the start of the recovery stub and is the last function in the .text section. This covers about 140,180 blocks. The blocks don’t necessarily align with instructions or function boundaries, therefore producing misleading disassembly that hinders static analysis.

The entry/recovery stub reconstructs the code through the following sequence:

1. Locate the protected region:

A call $+5/pop sequence obtains the stub's current address. The code then calculates the protected region's location (0x140001000) relative to that address.

2. Derive the permutation seed:

The stub computes a 64-bit FNV-1a hash over its first 15 bytes and bytes 23–244 (end of the stub). The eight bytes at offsets 15–22 are excluded because they contain an encoded seed. XORing the encoded seed with the calculated hash produces the linear congruential generator's initial state to be used in step 3:

This ties correct restoration to the stub's exact bytes: modifying a hashed instruction changes the recovered seed. This also means that setting a software breakpoint anywhere in the stub results in an incorrect restoration at runtime.

3. Advance to the end of the generator sequence:

The stub initializes a deterministic 64-bit number generator with the recovered seed. Each update multiplies the current state by A (0xF7A874C6B9DE43D5), adds C (0xE0ED02C1BBE35BB7), and retains only the lowest 64 bits. It performs 140,179 updates to reach the state needed to begin reversing the block-shuffle sequence, since the restoration loop must traverse the generator's states backward:

4. Restore the original block order:  

Starting with block 1, the stub takes the generator state's upper 31 bits and reduces that value to an index between zero and the current block number. It then exchanges the two 16-byte blocks.

After each iteration, the generator moves backward by subtracting the original increment and multiplying by the inverse constant, A_inverse (0xF40FBF0EDD42DD7D), again retaining only the lowest 64 bits. The stub continues through the remaining blocks, reconstructing the original code order. Iterations that select the current block leave its contents unchanged but still update the generator:

How the stealer checks for a prior infection

The infostealer initializes the Component Object Model (COM) and hides and releases its console. It then creates five randomly named mutexes. These mutexes aren’t used as a stable single-instance check. Instead, the malware checks a marker at%APPDATA%\.cobra before proceeding. An existing marker file causes an early exit; if it’s absent, this stage attempts to create it and continues. Because the preceding first-stage Python loader uses the same path, a retained marker under the same user profile can suppress the native stage. The marker's presence therefore doesn’t establish that the infostealer completed its work:

What data the information stealer collects

When the marker check permits execution, the application gathers system information, clipboard text, process listings, Wi-Fi profile names, and a screenshot. Additional dispatchers target wallets and browser extensions, messengers, remote-access and file transfer protocol (FTP) applications, virtual private network (VPN) clients, browsers, and game clients.

Verified AI-client collection paths include:

• %APPDATA%\Claude\config.json

• %APPDATA%\Cursor\User\storage.json

• %APPDATA%\Cursor\User\settings.json

• %APPDATA%\Windsurf\.env

• %APPDATA%\Windsurf\auth.json

The corresponding archive entries are placed under Network Protocol Clients/MCP/. The file-reading helper checks for a complete read and skips empty files or reported sizes above 50 MiB. 

A generic file collector separately targets Desktop, Documents, Downloads, Pictures, and Videos.

How Chrome App-Bound Encryption is handled

The malware includes collectors for Chrome, Edge, Firefox, and Yandex. The Chrome branch implements a multistage process to recover protected browser keys and read profile databases. It also extracts saved passwords, session cookies, browsing history, download records, and profile metadata.

Before it can reach the key material, the collector performs four privilege-related operations:

• Enumerate browser data directories under C:\Users.

• Enable SeDebugPrivilege, SeBackupPrivilege, and SeRestorePrivilege. These requests activate privileges already present in the process token and don’t independently grant administrative access.

• Duplicate a SYSTEM-context impersonation token from lsass.exe or winlogon.exe.

• Search running processes for a token belonging to the browser profile’s owner, using token information and SID-to-account lookup to identify a matching user.

The collector then reads app_bound_encrypted_key from Chrome's Local State file and Base64-decodes the value. It removes its leading APPB prefix. Then it attempts to unwrap the outer data protection application programming interface (DPAPI) protection under SYSTEM impersonation and, where another DPAPI-protected layer remains, switches to the corresponding user context for a second CryptUnprotectData operation. This distinction matters because filesystem access alone doesn’t provide the user-specific key material needed for DPAPI decryption.

The system processes the resulting key envelope according to its format selector. Implemented variants are as follows:

For variant 3, it attempts to open Google Chromekey1 through the Microsoft Software KSP and to unwrap the supplied encrypted component using NCryptDecrypt. If it fails, it tries five hard-coded key names: Microsoft Edgekey1, Microsoft Edge, Edge, Google Chromekey1, and Chrome. If these attempts fail, the helper enumerates keys exposed by the same provider under the impersonated context. It attempts decryption with each candidate that it successfully opens and returns the first successful result.

For browser database access, the collector first attempts ordinary reads of browser databases. It also prepares Volume Shadow Copy Service operations and uses the resulting snapshot path as a fallback when normal reads fail. It loads database bytes into an in-memory SQLite database for querying. With database access and the decrypted browser key, it can then decrypt data from Login Data and Network\Cookies.

Data exfiltration through Telegram

The infostealer uses two separate Telegram configurations, where bot tokens are recovered from embedded data using XOR with 0xAA:

The tool places collected data into categorized folders before archiving and exfiltration: System, Media, Files, browsers, Network Protocol Clients/MCP, servers, Questionable, and Games. 

The following example shows Telegram output captured during a contained execution of the information stealer:

The unused Dropbox payload path

The infostealer also contains a Dropbox download-and-execute path set to hxxps://www.dropbox[.]com/scl/fi/tbxu5vgr9l1vuw3s7rw7v/VisualStudioSetup.exe?rlkey=o6dpwfynneuxeyok7g5trtv96&st=nj5jxsoe&dl=1. It saves the response as %TEMP%\visual.exe and attempts to launch it with no-console settings. It schedules deletion after 60 seconds. However, this appears to be a validly signed Microsoft Visual Studio 2022 Community installer bootstrapper, likely used as a front. 

REF8801 and MITRE ATT&CK

Elastic uses the MITRE ATT&CK (v19) framework to document common tactics, techniques, and procedures that threats use against enterprise networks.

Tactics

Tactics represent the why of a technique or sub-technique; it’s the adversary's tactical goal, the reason for performing an action:

• Collection

• Command and Control

• Credential Access

• Defense Impairment

• Discovery

• Execution

• Exfiltration

• Privilege Escalation

• Resource Development

• Stealth

Techniques

Techniques represent how an adversary achieves a tactical goal by performing an action:

• Abuse Elevation Control Mechanism

• Access Token Manipulation: Parent PID Spoofing

• Access Token Manipulation: Token Impersonation/Theft

• Archive Collected Data

• Browser Information Discovery

• Clipboard Data

• Command and Scripting Interpreter

• Credentials from Password Stores: Credentials from Web Browsers

• Data Encoding: Standard Encoding

• Data from Local System

• Deobfuscate/Decode Files or Information

• Disable or Modify Tools

• Encrypted Channel: Symmetric Cryptography

• Exfiltration Over Web Service

• File and Directory Discovery

• Hide Artifacts: Hidden Files and Directories

• Hide Artifacts: Hidden Window

• Indicator Removal: File Deletion

• Ingress Tool Transfer

• Input Capture: GUI Input Capture

• Masquerading

• Modify Registry

• Native API

• Obfuscated Files or Information

• Process Discovery

• Reflective Code Loading

• Screen Capture

• Social Engineering

• Stage Capabilities: Upload Malware

• Steal Web Session Cookie

• System Information Discovery

• System Network Configuration Discovery

• System Owner/User Discovery

• Virtualization/Sandbox Evasion: System Checks

Detecting and preventing REF8801

Detection and prevention rules

The following endpoint prevention and detection rules address behaviors associated with REF8801:

• AMSI Bypass from Suspicious Module

• AMSI Bypass via Unbacked Memory

• AMSI or WLDP Bypass via Memory Patching

• Connection to WebService by an Unsigned Binary

• Curl Download Activity from npm Package Install

• DNS Query to Suspicious Top Level Domain

• Evasion via Event Tracing for Windows Patching

• Execution of a Windows Script File Written by a Suspicious Process

• External IP Address Discovery via Untrusted Program

• Hollow Image Behavior via Native API

• Native API Call from Unsigned Module

• NTDLL Memory Protection Change via Unsigned DLL

• Potential Browser Information Discovery

• Suspicious Access to Web Browser Credential Stores

• Suspicious PowerShell Base64 Decoding

• Suspicious PowerShell Execution via Windows Scripts

• Suspicious PowerShell from npm Package Install

• Suspicious Windows Core Module Change

• VirtualAlloc API Call from an Unsigned DLL

• Web Browser Credential Access via Unsigned Process

Observables and indicators of compromise

This research discusses the following observables:

References

• @copilot-mcp/apex: A macOS Infostealer Re-Published on npm After Takedown

• CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode