Fake Web3 Accelerator Pushed Malicious npm Packages Posing as Free AI Credits

Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic have detailed a campaign in which attackers posed as a Web3 venture accelerator called Apex Accelerator. The operation, tracked as REF8801, targeted crypto startup founders with offers of free Anthropic Claude and Google Gemini credits, coding tools, and security audits.

The npm lure

Two packages, each built for both Windows and macOS, did the work: @apexacc/cli, billed as an "AI advisor for Web3 founders" powered by Claude Fable 5 and Gemini 2.5 Flash, and @apexacc/audit, an MCP server exposing eighteen tools for scanning tokens, wallets, and smart contracts. Both were published by an npm user named apexaccelerator, linked to a GitHub account apexaccs and an entity called the Apex Foundation.

The campaign isn't new. Back in late July 2026, SafeDep flagged three other packages from the same crew distributing a macOS stealer from the Atomic Stealer (AMOS) family. Since April 2026 the foundation has been tied to the domains apexaccs.org and apexfdn.xyz. Archived snapshots show it advertising $235,000 investments, grants, and introductions to VCs. On X, the operators approached developers of crypto wallets and trading tools with investment offers and instructions to run their "due diligence" tool. To look legitimate, the group showed up at conferences such as TOKEN2049 in Singapore.

What they really did

The packages never delivered the promised features: the audit tool produced fabricated findings, and the scoring test returned an assessment of a fictitious project. Their real job was to drop the CloudSyncD backdoor on macOS and a custom Windows infostealer that exfiltrated data over Telegram.

On Windows the chain ran through PowerShell and several PyInstaller loaders with a UAC bypass via UACME; a final Go loader patched AMSI and ETW, unhooked ntdll.dll, and ran shellcode. The stealer harvested wallet data, browser extensions, messengers, VPN and FTP clients, and bypassed Chrome's app-bound encryption to extract saved passwords and cookies. On macOS, the CloudSyncD dropper phished the user's login password through a fake authorization prompt to run with sudo privileges. Jamf Threat Labs documented that backdoor last month, when it spread disguised as a Zoom installer.

Hitting the AI agents

The campaign's twist is LLM traffic interception. The packages rerouted OpenRouter requests and registered an attacker-controlled MCP server in the victim's agent configuration. That gave the attackers visibility into prompts, conversation history, code snippets, and tool outputs — and let them inject their own instructions to steer the agent's next moves.

Source: The Hacker News