1.1 Incident Timeline#

1.2 Why Does This Incident Matter?#

Unlike traditional virus propagation, this attack is a classic supply chain attack. The attacker did not directly target users, but instead chose to compromise Apifox’s official software distribution channel, “legitimately” distributing malicious code to victims’ computers without their knowledge.

Developers’ computers store the “keys” to their organizations’ core assets:

• SSH private keys → direct login to production servers
• Git Tokens → access and modification of code repositories
• Cloud service Access Keys → control of cloud infrastructure
• Database passwords → access to sensitive data

A single leaked key can lead to the compromise of an entire corporate intranet.

2.1 Attack Environment: Security Flaws in the Electron Framework#

The Apifox desktop client is built on the Electron framework and has the following security issues:

Core vulnerability point: Because the sandbox was not strictly enabled, malicious JS code loaded over the network gained full privileges in the local Node.js environment, allowing it to directly read and write the local filesystem and execute system commands.

2.2 Poisoning Mechanism#

1
URL: https://cdn.apifox.com/www/assets/js/apifox-app-event-tracking.min.js
2
Normal size: about 34KB
3
Malicious size: about 77KB

1
cdn.apifox.com → CNAME → qiniudns.com (Qiniu Cloud CDN)

2.3 Malicious Domain#

The attacker registered a highly deceptive domain:

1
apifox.it.com

This domain mimics the format of the official domain, aiming to bypass the vigilance of users and some security software.

3.1 Attack Flow Diagram#

3.2 Attack Phase Details#

1
3. **Connect to C2 server**:
2
   Send a request to `apifox.it.com` to retrieve the second-stage malicious payload.
3

4
4. **Decrypt and execute**:
5
   Use the embedded RSA-2048 private key to decrypt the payload, then execute it via the `eval()` function.
6

7
#### Phase Three: Core Data Theft
8

9
The second-stage script systematically scans for and steals the following sensitive files:
10

11
| Type | Path | Risk |
12
|------|------|------|
13
| SSH private keys | `~/.ssh/id_rsa` etc. | Direct server login |
14
| Git credentials | `~/.git-credentials` | Access to code repositories |
15
| Command line history | `~/.bash_history`, `~/.zsh_history` | May contain plaintext passwords |
16
| K8s config | `~/.kube/*` | Control of Kubernetes clusters |
17
| npm credentials | `~/.npmrc` | Access to private package repositories |
18
| Cloud Access Keys | Various cloud provider configs | Control of cloud infrastructure |
19

20
All stolen data is packaged, encrypted using **AES-256-GCM**, and then exfiltrated to the attacker's server.
21

22
### 3.3 Communication Characteristics
23

24
- **Low-frequency beacon**: Random intervals between 30 minutes and 3 hours
25
- **Encrypted communication**: Uses RSA-2048 to encrypt payloads
26
- **Covert transmission**: Custom request headers, disguised as normal traffic
27

28
---
29

30
## 4. Scope of Impact
31

32
### 4.1 Affected Versions
33

34
- **Affected versions**: Apifox SaaS desktop client **versions below 2.8.19**
35
- **Affected platforms**: Windows, macOS, Linux — all platforms
36
- **Affected period**: March 4 to March 22, 2026
37

38
### 4.2 Unaffected Versions
39

40
- Web version (browser access)
41
- Private deployment version
42
- v2.8.19 and above
43

44
### 4.3 Why Are Developers High-Risk Targets?
45

46
The attacker's goal is not photos or documents on personal computers, but the "keys" in developers' hands that lead to their organizations' core assets:

1
Developers' computers thus become excellent springboards for attackers to **move laterally** and **penetrate corporate intranets**.
2

3
---
4

5
## 5. Self-Check Guide
6

7
### 5.1 Windows Users
8

9
Open PowerShell (as Administrator) and run:
10

11
```powershell
12
Select-String -Path "$env:APPDATA\apifox\Local Storage\leveldb\*" -Pattern "rl_mc","rl_headers" -List | Select-Object Path

5.2 macOS Users#

Open Terminal and run:

1
grep -arlE "rl_mc|rl_headers" ~/Library/Application\ Support/apifox/Local\ Storage/leveldb

5.3 Linux Users#

Open Terminal and run:

1
grep -arlE "rl_mc|rl_headers" ~/.config/apifox/Local\ Storage/leveldb

5.4 Interpreting Results#

• Specific files output → Compromised, immediate remediation measures required
• No output → Possibly not infected, but protective measures are still recommended

Note: Because the files being checked are cache files, false negatives are possible. If you used the Apifox desktop client during the attack window (March 4–22), there is a very high probability that you were attacked.

6.1 Immediately Upgrade the Client#

This is the most direct and effective way to stop the attack.

1
Fixed version: v2.8.19 and above
2
Fix method: Abolish online dynamic loading of JS, switch to local built-in packaging

6.2 Comprehensively Rotate Sensitive Credentials#

This is the most critical step in remediation. You must assume that all credentials ever stored on affected devices have been leaked.

1
# Back up the old key
2
mv ~/.ssh/id_rsa ~/.ssh/id_rsa.old
3
mv ~/.ssh/id_rsa.pub ~/.ssh/id_rsa.pub.old
4

5
# Generate a new key
6
ssh-keygen -t ed25519 -C "your_email@example.com"
7

8
# Deploy the new public key to the server
9
ssh-copy-id user@server

6.3 Network-Level Blocking#

Block the following suspicious domains at the network level:

1
apifox.it.com
2
cdn.openroute.dev
3
upgrade.feishu.it.com
4
system.toshinkyo.or.jp
5
ns.feishu.it.com

6.4 Check Server Logs#

Review server login logs to check for abnormal SSH logins:

1
# Check recent SSH login records
2
last -a | head -20
3

4
# Check authentication logs
5
grep "Accepted" /var/log/auth.log | tail -20

7.1 Characteristics of Supply Chain Attacks#

1. Highly covert: Malicious code is obfuscated and encrypted, making it hard to detect
2. Automatic execution: Triggered upon client startup, requiring no user interaction
3. Probabilistic triggering: Not every request returns the malicious version
4. Precisely targeted: Clearly aimed at developers’ high-value assets
5. Runs with high privileges: Exploits framework vulnerabilities to gain system-level privileges

7.2 Developer Security Best Practices#

7.3 Recommendations for Electron App Development#

If you are an Electron app developer, please note:

1
// ✅ Enable the sandbox
2
const win = new BrowserWindow({
3
  webPreferences: {
4
    sandbox: true,
5
    contextIsolation: true,
6
    nodeIntegration: false,
7
    preload: path.join(__dirname, 'preload.js')
8
  }
9
});
10

11
// ❌ Avoid doing this
12
const win = new BrowserWindow({
13
  webPreferences: {
14
    nodeIntegration: true,
15
    contextIsolation: false
16
  }
17
});

• Enable sandbox and contextIsolation
• Disable nodeIntegration
• Use preload scripts to safely expose necessary APIs
• Avoid dynamically loading executable code from the network
• Implement Content Security Policy (CSP)