Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic reported that a fake Web3 accelerator called Apex Accelerator, tracked as REF8801, used malicious npm packages @apexacc/cli and @apexacc/audit to deliver information-stealing malware and backdoors to Windows and macOS systems while advertising free AI credits for Anthropic Claude and Google Gemini. The @apexacc/audit package claimed to be a Model Context Protocol server exposing 18 security tools but generated fabricated findings, and the operation repackaged a legitimate coding agent to route model requests through attacker-controlled services. The packages, published by npm user "apexaccelerator" and linked to GitHub account "apexaccs" and the Apex Foundation, are no longer accessible, and SafeDep had previously detailed three related packages (@apexfdn/apex, @copilot-mcp/apex, @apexfdn/copilot-mcp) in late July 2026 that distributed the Atomic Stealer macOS malware family.

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence AI credits for Anthropic Claude and Google Gemini, coding tools, and security audits. “The tools delivered information-stealing malware and backdoors for macOS and Windows machines,” Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages . “The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings.” The scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups and founders. It’s being tracked under the moniker REF8801 . The names of the npm packages, each of which targets both Windows and macOS machines, are listed below – - @apexacc/cli https://socket.dev/npm/package/@apexacc/cli Apex Copilot CLI — AI advisor for Web3 founders – - @apexacc/audit https://socket.dev/npm/package/@apexacc/audit Web3 Security Scanner — 18 tools for DYOR and smart contract auditing While both the packages and their associated GitHub repositories are no longer accessible, “@apexacc/cli” was advertised as an “AI advisor for Web3 founders” that’s powered by Claude Fable 5 and Gemini 2.5 Flash. “@apexacc/audit,” on the other hand, claimed to be a Model Context Protocol MCP server exposing 18 security tools for scanning tokens, wallets, and smart contracts. Both packages were published by an npm user named “apexaccelerator” and linked to a GitHub account called “ apexaccs https://github.com/apexaccs ” and an entity referred to as the Apex Foundation. Interestingly, the campaign itself is not new. In late July 2026, SafeDep detailed https://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.html npm-install-triggers-stealer three other npm packages linked to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer aka AMOS family – - @apexfdn/apex - @copilot-mcp/apex , which features the same package description as “@apexacc/cli” - @apexfdn/copilot-mcp https://socket.dev/npm/package/@apexfdn/copilot-mcp , which claims to be an Apex Copilot and MCP server for “portfolio diligence and operator tools” Artifacts captured by Socket show that the Apex Foundation has been linked to at least two distinct domains since April 2026 - apexaccs . org - apexfdn . xyz According to Internet Archive snapshots https://web.archive.org/web/20260318075933/https://apexfdn.xyz/ dating back to March 19, 2026, the foundation states: “The Apex Foundation offers $235,000 investments, grants, and partnerships, and connects projects with VCs, angels, and private equity if they don’t meet our criteria.” Posts shared on X show the accelerator approaching developers of cryptocurrency wallets https://x.com/hialex sol/status/2099575319002800415 and market intelligence tools https://x.com/thegreatola/status/2109393608906588531 for traders with offers of direct investment and instructions to run their due diligence tool “@apexacc/cli” . In the case of the latter, the npm package has been found to drop an encrypted malware loader disguised as an Apple app “com.apple.system.loader” . “The group also sought to build credibility through its presence at TOKEN2049 https://www.token2049.com/ in Singapore and other in-person events it has hosted in the past,” Elastic said. “The group attempts to manufacture legitimacy by appearing at widely attended conferences, indirectly lending credibility to the project.” Once installed, neither of the npm packages provides the promised functionality. The 18 security tools part of the @apexacc/audit package generate fabricated findings, while @apexacc/cli’s scoring test returns an unsupported assessment of a fictitious project. Instead, their primary responsibility is to propagate a macOS backdoor called CloudSyncD and a custom Windows information stealer that exfiltrates data through Telegram. The platform-specific executables are retrieved from the projects’ GitHub releases. Both packages implement a distinct verification path for Windows and macOS by sending an HTTP POST request to “win32” or “darwin” to “vrf.apexaccs . org/api/v1/vrf” to initiate the appropriate next stage. The Windows and macOS infection chains are as follows – Windows – - The malware retrieves a Base64-encoded PowerShell command, which reaches out to another endpoint “0auth-chromium . com/APIService” to fetch a second PowerShell script “drop.ps1” that downloads an executable “bludness.exe” from “ehegisnightmare . icu” and launches it in a hidden window. - The PyInstaller executable is a Python loader that checks if it already has administrator privileges and, if so, downloads the next stage from “ehegisnightmare . icu,” saves it as “%TEMP%\exegis.exe,” and launches it. If not, it attempts to bypass User Account Control UAC using UACME’s ucmDebugObjectMethod https://github.com/hfiref0x/UACME/blob/3f1885cab0e3a277db0cadc83d0a782bafa9e4cd/Source/Akagi/methods/tyranid.c L435 . - The “exegis.exe” binary is another PyInstaller executable that collects system metadata, running processes, and performs anti-virtual-machine anti-VM checks before decrypting and launching a bundled loader as “%TEMP%\updater loader.exe.” - The Golang executable patches Antimalware Scan Interface AMSI and Event Tracing for Windows ETW , unhooks “ntdll.dll” https://cymulate.com/blog/extracting-syscalls-from-a-suspended-process/ to blind endpoint security tools, and loads the next-stage shellcode into its own memory. - The shellcode is a native information stealer that examines for signs of a prior infection and then harvests system information, clipboard text, process listings, Wi-Fi profile names, screenshots, and data from wallets, browser extensions, messengers, remote-access and file transfer protocol FTP applications, virtual private network VPN clients, browsers Google Chrome, Microsoft Edge, Mozilla Firefox, and Yandex , and game clients. The stealer can also bypass Chrome’s app-bound encryption ABE https://thehackernews.com/2024/08/google-chrome-adds-app-bound-encryption.html protections to extract saved passwords, session cookies, browsing history, download records, and profile metadata. The collected data is exfiltrated through Telegram. macOS – - The malware downloads a remotely hosted bash script and executes it on the machine. - The shell script downloads a GZIP-compressed archive from “verify.apexfdn . xyz/unix/,” saves it as “package.tar.gz” in a temporary directory, and extracts its contents. - The archive contains a dropper for CloudSyncD, which first phishes the victim’s system login password using a fake authorization prompt and then uses it to launch an embedded payload with sudo privileges. The payload performs host discovery, collects hardware and operating-system details, and then contacts an external server “ccmihr . com” to transmit the data and receive further tasks that allow the malware to download and run additional payloads. It’s worth noting that CloudSyncD was first documented https://www.jamf.com/blog/cloudsyncd-macos-backdoor-fake-zoom-installer/ by Jamf Threat Labs late last month, detailing its propagation via a fake Zoom installer. The malware was detected in the wild in mid-September 2026. “Its behaviors illustrate how macOS malware continues to move toward native implementations, string protection, and execution paths that attempt to avoid writing payloads to disk, while still depending on the oldest technique available: asking the user for their password,” Jamf said. Besides deploying a stealer and backdoor depending upon the infected operating system, the packages are capable of intercepting and redirecting OpenRouter large language model LLM traffic, as well as registering an MCP server under their control in the victim’s agent configuration. “These changes allow the attacker-controlled API to receive the prompts, conversation history, code snippets, and tool outputs included in the agent’s LLM requests,” Elastic researchers explained. “The attacker’s MCP server can also supply instructions that are added to the agent’s prompt, along with tool names, descriptions, and accepted inputs that help the model decide which tools to invoke and how to use them. Together, these mechanisms give the attacker visibility into the submitted data and a way to influence the agent’s subsequent actions.”