---
title: Hunt: REF8801 / Apex npm tools on dev and founder machines (~/.apex/agent/mcp.json, OPENROUTER_BASE_URL rewrite, *.apexaccs[.]org) | ctxsec
url: https://ctxsec.com/items/hunt-ref8801-apex-npm
description: ""
status: "hunt idea (Elastic IOCs)"
published: 2026-10-12
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-ref8801-apex-npm.md)

hunt idea (Elastic IOCs)

2026-10-12

### Hunt: REF8801 / Apex npm tools on dev and founder machines (~/.apex/agent/mcp.json, OPENROUTER_BASE_URL rewrite, *.apexaccs[.]org)

(1) Packages: @apexacc/cli and @apexacc/audit in npm caches and lockfiles; binaries named apex-windows-x64.exe, apex-audit-windows-x64.exe, apex-darwin-arm64, apex-verify-darwin, apex-audit-verify-darwin. (2) Files: ~/.apex/agent/mcp.json with an apex-copilot entry; on Windows, a Defender exclusion for the .apex folder and %TEMP%\_apex_run.ps1 / _apex_run.vbs (the second pair is reported by Vigilance). (3) Network/DNS: apexaccs[.]org and arena., vrf., token. subdomains; apexfdn[.]xyz; ccmihr[.]com (CloudSyncD C2); 0auth-chromium[.]com; ehegisnightmare[.]icu; arenapex[.]cloud; cloudmain365duo[.]top; fdn4apex[.]com; main.router-apex[.]com; update.apex-arena-router[.]com. (4) Process: PowerShell spawned from an npm install, curl downloads during an npm install. If you find any of this, rotate every API key typed into the tool plus wallet seeds and browser-stored credentials.

Sources: [Elastic Security Labs](https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages) · [Vigilance (@apexacc/cli 1.5.122 diff)](https://vigihq.com/attacks/apexacc-cli-defender-blinding-c2-loader)