Apifox Desktop Client Supply Chain Attack via Compromised Official CDN Script (apifox.it.com C2) — Threadlinqs Intelligence
As of 2026-05-30, Apifox Desktop Client Supply Chain Attack via Compromised Official CDN Script (apifox.it.com C2) is a critical-severity supply chain threat attributed to a China-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0295 · Severity: CRITICAL · CVSS: 9.1 · Status: PATCHED · Category: SUPPLY_CHAIN
Attribution: China · UNKNOWN
A supply chain attack targeting the Apifox desktop client was discovered where a front-end JavaScript file hosted on Apifox's official CDN was injected with heavily obfuscated malicious code. The
A sophisticated supply chain attack compromised the Apifox desktop client by injecting malicious JavaScript into a legitimate analytics tracking script hosted on Apifox's official CDN. The poisoned file, apifox-app-event-tracking.min.js, grew from approximately 34KB to 77KB with the addition of roughly 42KB of heavily obfuscated malicious code.
The attack operates in multiple stages. Stage 1 (Loader): The injected code appended to the legitimate CDN script detects the Electron desktop environment by attempting to import Node.js modules (crypto, os) unavailable in browsers. Once confirmed, it beacons to the C2 domain apifox.it.com, sending machine fingerprinting data via custom HTTP headers (af_uuid, af_os, af_user, af_name, af_apifox_user, af_apifox_name). The af_uuid is a SHA-256 hash of concatenated MAC address, CPU model, hostname, user home directory, and OS platform, cached in localStorage as _rl_mc. The C2 responds with a 344-byte RSA-encrypted payload that, when decrypted with the embedded RSA-2048 private key (OAEP padding, SHA-256), returns a dynamically-generated Stage 2 URL with a randomized 8-character hex filename.
Stage 2 (Information Harvesting): Delivered as plaintext Node.js scripts, Stage 2 payloads systematically harvest sensitive files. Version 1 (collectPreInformations) recursively reads ~/.ssh/ (private keys, authorized_keys, config), ~/.git-credentials, shell histories (.zsh_history, .bash_history), and executes process listing commands (ps aux on Linux/macOS, tasklist on Windows). Version 2 (collectAddInformations) expands scope to include Kubernetes configs (~/.kube/*), npm registry tokens (~/.npmrc), Subversion credentials (~/.subversion/*), shell environment variables, and performs directory tree traversal up to 2 levels deep. On Windows, it additionally scans D:/, E:/, F:/ drives.
All harvested data is compressed via Gzip, encrypted with AES-256-GCM using a key derived from scryptSync with passphrase 'apifox' and salt 'foxapi' (32-byte key), then Base64-encoded in the format IV[12] + AuthTag[16] + CipherText before being POSTed to /event/0/log (v1) or /event/2/log (v2) endpoints.
The C2 infrastructure used the domain apifox.it.com, registered through a .it.com commercial subdomain service (non-ICANN) to appear as an official Apifox property. The domain resolved to Cloudflare IPs (104.21.2.104, 172.67.129.21) and was active for 18 days (March 4-22, 2026). The backend infrastructure ran Nginx 1.28.2 with an Express (Node.js) application, implementing one-time-use Stage 2 URLs that permanently 404 after delivery, fully open CORS, and no-cache response headers.
The obfuscation employed 7 layers: (1) String array rotation via _0x10e4() with 300+ encoded strings, (2) Base64 + RC4 double-decryption, (3) Proxy function wrappers, (4) Hexadecimal arithmetic expressions masking constants, (5) Control flow flattening, (6) Dead code injection, (7) Anti-debugging via toString regex and infinite recursion loops. Notably, while the entrance code was heavily obfuscated, Stage 2 payloads contained Chinese-language development comments explaining encryption parameters, suggesting separate authorship or overconfidence in the RSA encryption protecting the delivery channel.
The malicious code includes a persistence mechanism using randomized setTimeout intervals between 30 minutes and 3 hours, with a finally block ensuring scheduleNext() executes even after network failures or eval errors, maintaining continuous C2 polling.
Apifox confirmed the compromise on March 25, 2026 and released version 2.8.19 which moved tracking scripts from CDN retrieval to bundled package resources. Only the public SaaS desktop client was affected; web and self-hosted versions were not impacted.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: technology, software-development, cryptocurrency, fintech, cloud-services, api-development
Target regions: Global, Asia, North America, Europe
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1059, T1027, T1140, T1036, T1552, T1539, T1082, T1057, T1083