Executive Summary
The Apex Foundation campaign is a persistent supply chain threat targeting macOS users, particularly in the Web3 and cryptocurrency sectors. After the npm security team removed the initial dropper `@apexfdn/apex`, the operator re-published the same malicious code under the scope `@copilot-mcp/apex` within 11 hours. The campaign utilizes a sophisticated postinstall dropper chain that downloads a legitimate-looking but weaponized binary from GitHub releases to evade static analysis and registry-level scanning.
Technically, the malware functions as a multi-stage stealer from the AMOS (Atomic Stealer) family. It employs a fake system prompt to phish macOS login passwords, which are subsequently used to bypass security controls and harvest sensitive data, including browser credentials, over 20 types of cryptocurrency wallets, Telegram sessions, and shell histories. The presence of a hosted MCP endpoint (`arena.apexfdn.xyz`) indicates the threat is not solely reliant on npm distribution, posing a significant risk to organizations using AI coding agents and developer ecosystems.