Security Alert: Supply Chain Attack on Apifox Desktop Client via Compromised Official CDN Script
1. Background
The SlowMist security team has detected a supply chain attack in which a front-end script file hosted on Apifox’s official CDN
(hxxps[:]//cdn.apifox.com/www/assets/js/apifox-app-event-tracking.min.js)
was injected with heavily obfuscated malicious JavaScript code.
Disguised as legitimate analytics tracking functionality, the malicious code, when executed within the Apifox Electron desktop client environment, steals user authentication credentials and sensitive system information, and sends them to a C2 server controlled by the attacker. It then retrieves and executes arbitrary remote code, ultimately achieving full remote command execution (RCE).
2. Analysis of the Injection Vector
The attack entry point is the tampering of resources on Apifox’s official CDN:
Legitimate resource:
hxxps://cdn.apifox.com/www/assets/js/apifox-app-event-tracking.min.js
Malicious version (restored via Web Archive):
hxxps://web.archive.org/web/20260305051418/hxxps://cdn.apifox.com/www/assets/js/apifox-app-event-tracking.min.js
A comparison of the samples shows that the malicious version embeds obfuscated malicious code on top of the original legitimate analytics logic, enabling information theft and remote control.
2.1 Malicious JS Analysis
The malicious code was injected into the Apifox official CDN script. The Apifox desktop client (built on the Electron framework) automatically loads this script during startup or runtime, triggering the malicious behavior without any user interaction.
2.2 Attack Flow
2.3 Periodic C2 Beaconing and Task Retrieval Mechanism
The malicious code contains a built-in randomized timer that executes periodically during the runtime of the Apifox client, continuously stealing data and fetching the latest payload.
2.4 Obfuscation and Anti-Detection Techniques
- The malicious code segment is heavily obfuscated using javascript-obfuscator.
- All strings are encrypted using the RC4 algorithm and stored in a large string array, then dynamically decrypted at runtime.
- All critical numeric constants (such as time intervals and chunk sizes) are expressed through multi-step computations to evade static analysis.
- All C2 communications are encrypted using RSA, with an embedded RSA private key (256-byte chunking) to prevent traffic analysis.
- The malicious code is appended after legitimate analytics code, leveraging whitelist trust to bypass security detection.
Recommendations
For affected users:
1. Immediately revoke historical accessTokens and check for any abnormal API call records.
2.Log out and re-login to the Apifox account to forcibly invalidate the current Token.
3. Change the Apifox account password and check for any abnormal login activity.
4. Block apifox.it.com and all its subdomains at the network level.
5. Clear the Apifox client’s localStorage and delete the _rl_headers and _rl_mc keys:
- Execute the following in the Apifox client developer tools console:
localStorage.removeItem(‘_rl_headers’);localStorage.removeItem(‘_rl_mc’);
IoCs
Domain
apifox.it.com
*.apifox.it.com
URL
hxxp[:]//cdn.apifox.com/www/assets/js/apifox-app-event-tracking.min.js
hxxp[:]//cdn.apifox.com/www/assets/js/user-tracking.min.js
File
filename: apifox-app-event-tracking.min.js
SHA256: 91d48ee33a92acef02d8c8153d1de7e7fe8ffa0f3b6e5cebfcb80b3eeebc94f1
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
