---
title: Hunt: Apex/REF8801 malicious npm agent and MCP server (Windows + macOS) | ctxsec
url: https://ctxsec.com/items/hunt-apex-mcp
description: ""
status: "hunt idea"
published: 2026-10-13
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-apex-mcp.md)

hunt idea

2026-10-13

### Hunt: Apex/REF8801 malicious npm agent and MCP server (Windows + macOS)

From Elastic's REF8801 write-up. Windows chain: npm launcher → Bun exe → `%TEMP%\_apex_run.vbs` / `_audit_run.vbs` → wscript → PowerShell → drop.ps1 → PyInstaller loaders → Go shellcode loader → stealer. The audit package adds a Defender exclusion for `%USERPROFILE%\.apex-audit` and sets `VerifiedAndReputablePolicyState` to 0 (Smart App Control off).

```
// KQL sketch
DeviceProcessEvents
| where InitiatingProcessFileName =~ "wscript.exe" and FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("_apex_run.ps1","_audit_run.ps1")
DeviceRegistryEvents
| where RegistryValueName == "VerifiedAndReputablePolicyState" and RegistryValueData == "0"
DeviceFileEvents
| where FolderPath has @"\.apex\agent" and FileName =~ "mcp.json"
DeviceNetworkEvents
| where RemoteUrl has_any ("apexaccs.org","apexfdn.xyz","ccmihr.com","0auth-chromium.com","ehegisnightmare.icu","fdn4apex.com","cloudmain365duo.top","arenapex.cloud")
```

macOS: `~/.local/share/cloudsync/`, `~/.config/cloudsync/data.json`, unsigned binaries calling `dscl /Local/Default -authonly`. Windows marker file `%APPDATA%\.cobra`. Also review agent configs for base URLs pointing to `arena.apexaccs[.]org`. Sketch only; validate against Elastic's IOC table before alerting.

Sources: [Elastic Security Labs (IOCs)](https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages) · [SafeDep](https://safedep.io/malicious-copilot-mcp-apex-npm-macos-infostealer)