Full Report
Most of this week's trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out. The danger was
Analysis Summary
# Morning News Roll-up July 23, 2026
## Overview
The "ThreatsDay" bulletin highlights a trend of "deceptive utility," where malicious actors disguise threats as legitimate tools to infiltrate systems. Key incidents include supply chain attacks via package managers, counterfeit developer extensions, and security configuration changes in major repositories like GitHub and PyPI to combat credential theft and poisoning.
## Top Stories
### Npm Dropper Delivers macOS AMOS-family Infostealer
- Summary: A malicious npm package `@copilot-mcp/apex` was identified as a dropper for the AMOS (Atomic Stealer) malware. It uses AppleScript to phish for system passwords and harvests a wide array of sensitive data, including browser credentials, crypto wallets, SSH keys, and AWS/Kubernetes credentials. It maintains persistence via a LaunchAgent.
- Source: hxxps://safedep[.]io/malicious-copilot-mcp-apex-npm-macos-infostealer/
### Counterfeit VS Code Extension "Markdown All Pro"
- Summary: A rogue extension titled "Markdown All Pro" was discovered on the VS Code Marketplace impersonating a popular legitimate tool. Upon installation, it beacons system metadata to a hardcoded IP and establishes a live delivery channel capable of fetching and executing remote payloads without further user interaction.
- Source: hxxps://www[.]manifold[.]security/blog/a-beaconing-counterfeit-extension-on-the-vs-code-marketplace-the-markdown-all-pro-extension
### PyPI and GitHub Transition to Stricter Security Controls
- Summary: To combat account takeovers and repository poisoning, PyPI now rejects new file uploads to releases older than 14 days. Simultaneously, GitHub has mandated security patches for Enterprise Server (GHES) appliances, or it will begin rejecting command-line support bundle uploads starting August 18, 2026.
- Source: hxxps://blog[.]pypi[.]org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/
***
# Main Topic
**Deceptive Utility Threats: Supply Chain and IDE-based Malware Delivery**
## Key Points
- **Malicious Package Injection:** Attackers are leveraging the trust in ecosystems like npm and PyPI to distribute infostealers and backdoors.
- **Counterfeit Impersonation:** Malware is being successfully distributed through official marketplaces (VS Code) by mimicking the naming and branding of highly popular legitimate tools.
- **Multi-Stage Payloads:** Modern stealers, specifically the AMOS family, are utilizing complex execution chains involving AppleScript and osascript to bypass standard detection.
- **Proactive Registry Hardening:** Major repositories are moving toward "immutability" windows (e.g., PyPI's 14-day rule) to prevent the silent poisoning of historically stable software versions.
## Threat Actors
- **AMOS (Atomic Stealer) Operators:** Known for specifically targeting macOS environments and sensitive developer/crypto-user credentials.
- **Unattributed Extension Spoofers:** Operators focused on IDE-based entry points to gain footholds in developer environments for potential industrial espionage or further supply chain pivot.
## TTPs
- **T1584.005 (Infrastructure: Botnet):** Use of LaunchAgents for 60-second polling intervals to maintain persistence.
- **T1059.002 (Command and Scripting Interpreter: AppleScript):** Decrypting and running second-stage payloads on macOS.
- **T1566.001 (Phishing: Spearphishing Attachment):** Delivering malicious code disguised as legitimate utility extensions or packages.
- **Data Exfiltration:** Chunked HTTPS PUT requests to attacker infrastructure for exfiltrating `/tmp/osalogging.zip`.
## Affected Systems
- **macOS Devices:** Targeted by the AMOS-family stealer via npm.
- **Developer Environments:** Specifically Microsoft Visual Studio Code (all versions supporting external extensions).
- **GitHub Enterprise Server (GHES):** Versions 3.21.3, 3.20.5, 3.19.9, 3.18.12, and 3.17.18 and below (regarding support bundle uploads).
## Mitigations
- **Software Composition Analysis (SCA):** Audit npm and npx usage for the `@copilot-mcp/apex` or `@apexfdn/apex` packages.
- **Extension Sandboxing:** Restrict VS Code extension installations to verified publishers or internal curated lists.
- **System Patching:** Update GHES instances to the latest patch release (3.21.3+ recommended).
- **Network Filtering:** Block outbound cleartext HTTP traffic to unknown/hardcoded IPs and monitor for unusual chunked PUT requests.
## Conclusion
The current threat landscape shows a sophisticated pivot toward targeting developer tools. By tainting the environments developers use to build software, attackers can gain high-privilege access and bypass traditional security perimeters. Organizations should enforce strict package vetting and IDE extension policies to mitigate these risks.