From Elastic's REF8801 write-up. Windows chain: npm launcher → Bun exe → %TEMP%\_apex_run.vbs / _audit_run.vbs → wscript → PowerShell → drop.ps1 → PyInstaller loaders → Go shellcode loader → stealer. The audit package adds a Defender exclusion for %USERPROFILE%\.apex-audit and sets VerifiedAndReputablePolicyState to 0 (Smart App Control off).

// KQL sketch
DeviceProcessEvents
| where InitiatingProcessFileName =~ "wscript.exe" and FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("_apex_run.ps1","_audit_run.ps1")
DeviceRegistryEvents
| where RegistryValueName == "VerifiedAndReputablePolicyState" and RegistryValueData == "0"
DeviceFileEvents
| where FolderPath has @"\.apex\agent" and FileName =~ "mcp.json"
DeviceNetworkEvents
| where RemoteUrl has_any ("apexaccs.org","apexfdn.xyz","ccmihr.com","0auth-chromium.com","ehegisnightmare.icu","fdn4apex.com","cloudmain365duo.top","arenapex.cloud")

macOS: ~/.local/share/cloudsync/, ~/.config/cloudsync/data.json, unsigned binaries calling dscl /Local/Default -authonly. Windows marker file %APPDATA%\.cobra. Also review agent configs for base URLs pointing to arena.apexaccs[.]org. Sketch only; validate against Elastic's IOC table before alerting.