Malware

Apfell

Apfell is a JavaScript for Automation (JXA) agent for macOS/OSX that is part of the open-source Mythic/MythicAgents command-and-control framework. It is written in JavaScript specifically for macOS and is commonly referenced alongside other Mythic agents such as Apollo and Poseidon.

The provided content describes Apfell being delivered and executed through multiple infection chains. In one workflow, operators generate an Apfell JXA payload in Mythic, host the resulting .js file over HTTP, and use a Microsoft Office macro that invokes osascript to download and execute the payload on macOS. The content also states that Apfell has been used in malicious npm supply-chain campaigns, including eslint-verify-plugin and ambar-src, where macOS installations used osascript to run JavaScript that dropped or executed the Apfell payload.

High-confidence capabilities directly mentioned in the content include extensive data collection/reconnaissance, screenshot collection, theft of Google Chrome data, password capture via a fake prompt, and creation of a new macOS user with administrator privileges. One source also notes that the JXA payload launches inside the macOS App Sandbox, and claims Mythic can still add Login Item persistence from that context.

Behavioral and detection-relevant details in the content include Office applications such as Microsoft Word.app spawning /bin/sh, /bin/bash, or /usr/bin/curl as part of macro-based delivery, and osascript launching the JXA payload. The content further notes that some defenders monitor child processes spawned by osascript and shell commands on macOS. Reported infrastructure and artifacts associated with Apfell delivery in the supplied content include x-ya[.]ru as a staging source in the ambar-src campaign, function.yandexcloud[.]ru / Yandex Cloud as relay or exfiltration infrastructure, and the macOS Apfell JavaScript payload hash 492f2366ece5c544a4062da14da5883bc825d6f2bc58cda975799dca9f85b150, with an associated shell script hash 521ade4aeb95039e1712f8284eba333199fc819f1e0f9db41d6bc9849b131109.

The content ties Apfell to the Mythic framework and to malicious package campaigns reported by JFrog, Tenable, Socket, and others, but does not attribute Apfell itself to a single threat actor; rather, it is presented as an open-source payload used by multiple operators and campaigns in the wild.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

"Cybersecurity researchers have discovered four malicious NuGet packages... designed to target ASP.NET web application developers..." and "a malicious npm package named ambar-src..."

Execution

5 techniques

T1059Command and Scripting InterpreterEvidence2

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.

T1059.002AppleScriptEvidence1

Рабочее решение — apfell-агент, который работает через osascript (AppleScript, T1059.002, Execution) и не зависит от архитектуры процессора. Callback через osascript проходит на arm64 без проблем.

T1059.005Visual BasicEvidence1

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.

T1059.007JavaScriptEvidence2

Set up Mythic C2 server and generate an "apfell" jxa payload... Host that payload... uses osascript to download and execute the Mythic JXA .js payload.

T1204.002Malicious FileEvidence1

Copy and paste that macro into an MS Office doc.

Persistence

2 techniques

T1136Create AccountEvidence1

The macOS infection sequence executes Apfell... to conduct extensive data collection and create a new macOS user with admin privileges.

T1547.015Login ItemsEvidence1

Mythic does have the ability to add Login Item persistence even from the App Sandbox.

Privilege Escalation

1 technique

T1547.015Login ItemsEvidence1

Mythic does have the ability to add Login Item persistence even from the App Sandbox.

Stealth

2 techniques

T1036MasqueradingEvidence1

Remove the first line of the Mythic JXA .js launcher... Some static A/V signatures have been known to check for this static string.

T1218System Binary Proxy ExecutionEvidence1

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload.

Defense Impairment

1 technique

T1553.001Gatekeeper BypassEvidence1

Обход Gatekeeper (T1553.001, Defense Evasion)… Gatekeeper проверяет атрибут com.apple.quarantine у скачанных файлов и блокирует неподписанный или ненотаризованный код. А вот при доставке через curl, scp или rsync — не ставится, и Gatekeeper молчит.

Credential Access

2 techniques

T1552Unsecured CredentialsEvidence1

The malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments... It also harvests API keys for nine large language models (LLM) providers.

T1555Credentials from Password StoresEvidence1

The entire attack chain unfolds over two stages: a first-stage component that captures credentials and cryptocurrency keys and then loads a secondary stage that subsequently performs deeper harvesting of credentials from password managers.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The malicious code embedded into the packages comes with capabilities to siphon system information... Some of the data stolen by the agent are as follows - System information

Collection

2 techniques

T1113Screen CaptureEvidence1

Some of the data stolen by the agent are as follows - ... Screenshots

T1115Clipboard DataEvidence1

Some of the data stolen by the agent are as follows - ... Clipboard contents

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

The same is true for installing C2 Profiles: sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http | Installing Agents and C2 Profiles The Mythic repository itself does not host any Payload Types or any C2 Profiles... sudo ./mythic-cli install github https://github.com/MythicC2Profiles/http

T1071.001Web ProtocolsEvidence1

"...relays traffic... to the attacker's external C2 server" and "exfiltrated... to a Yandex Cloud domain"

T1105Ingress Tool TransferEvidence3

This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload... Host that payload... use python -m SimpleHTTPServer to host

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

"...begin transmitting the ASP.NET Identity data through the local proxy to the external infrastructure." and "Once the data is collected, it's exfiltrated..."

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

the hacker newsNews

Feb 25, 2026

Malicious NuGet Packages Stole ASP.NET Data; npm Package Dropped Malware

Mythic C2 JXA agent used on macOS to conduct reconnaissance, collect screenshots, steal data from Google Chrome, and capture system passwords via a fake prompt.

tenable blogNews

Feb 24, 2026

New malicious npm package 'ambar-src' targets developers with open source malware | Tenable®

Open-source Mythic agent for macOS (JavaScript) delivered via the malicious npm package’s preinstall chain; provides post-compromise capabilities such as host reconnaissance, screenshot capture, Chrome data theft, and credential/prompting via fake password dialogs.

the hacker newsNews

Feb 23, 2026

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

macOS JXA agent used for extensive data collection and privilege-establishing actions such as creating a new admin user.

red canary threat reportNews

Jan 1, 2026

C2 Frameworks - Red Canary Threat Detection Report

A Mythic agent implemented as a JavaScript for Automation script for OSX.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Apfell