Apifox Desktop Supply-Chain Attack Exposed Credentials and Enabled Remote Code Execution
Summary
SlowMist reported that a compromised Apifox CDN script ran automatically in the Electron desktop client, stealing credentials and system data and enabling remote code execution. The reported exposure window was March 4–22, 2026.
Key points
- SlowMist detected the attack in March 2026; the report identifies March 4–22 as the review window.
- The compromised official CDN script, apifox-app-event-tracking.min.js, reportedly ran automatically when the Apifox desktop client launched on Windows, macOS, and Linux.
- The payload reportedly stole Apifox tokens and targeted SSH keys, Git credentials, shell history, Kubernetes configuration, and npm credentials.
- The report says the malware sent stolen data over RSA-encrypted channels and fetched remote payloads from C2 infrastructure, enabling a persistent backdoor.
- Listed C2 domains include apifox[.]it[.]com and cdn[.]openroute[.]dev.
- The advisory recommends revoking and rotating potentially exposed credentials, reviewing access logs, and checking Apifox storage and systems for indicators of compromise.
- Kudelski Security's Cyber Fusion Center said it was monitoring the situation and developing a threat-hunting campaign.
Article Details
- Victim Organization
- Apifox
- Incident Type
- Supply-chain attack involving a compromised CDN-hosted JavaScript file in the Apifox desktop client
- Data Types Exposed
- Authentication tokens and session data
- API credentials
- SSH keys
- Git credentials
- Shell command history
- Kubernetes configurations and tokens
- npm authentication tokens
- Subversion credentials
- System information, including running-process data
- Operational Impact
- The malicious script was automatically executed when the affected desktop client launched. It stole credentials and system information, repeatedly exfiltrated data, and fetched and executed remote payloads to establish a persistent backdoor with remote code execution capability. Users who launched the client while the CDN script was compromised were affected; the source gives a March 4–22 window for reviewing logs but does not specify the year for that window.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apifox[.]it[.]com | Identified as the primary C2 domain; the source says it was active for 18 days and is now offline. |
| DOMAIN | cdn[.]openroute[.]dev | Identified as secondary C2 and payload-delivery infrastructure. |
| DOMAIN | ns[.]openroute[.]dev | Identified as DNS infrastructure related to the attack. |
| DOMAIN | system[.]toshinkyo[.]or[.]jp | Identified as a C2 communication endpoint. |
| DOMAIN | upgrade[.]feishu[.]it[.]com | Identified as a C2 communication endpoint. |
| SHA256 | 91d48ee33a92acef02d8c8153d1de7e7fe8ffa0f3b6e5cebfcb80b3eeebc94f1 | SHA-256 hash of the compromised JavaScript file apifox-app-event-tracking.min.js. |