{"id":3603,"date":"2026-10-19T12:28:28","date_gmt":"2026-10-19T12:28:28","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3603"},"modified":"2026-10-19T12:28:28","modified_gmt":"2026-10-19T12:28:28","slug":"fake-web3-accelerator-uses-npm-packages-to-spread-malware-and-hijack-ai-agent-traffic","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3603","title":{"rendered":"Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgAw5A6yrE0NkMreq5lBZaS4ndrFrorAZaVrjJ218aS1RcJoQVYOJOVejIn8rBH5RHIIZ_cpvtzHnQMwMMWVOFbpfcs01tolLCmlYAY3qy-onWaOUQhzB6H2VjlWaUgBCL_0vAjRB7VmumClnaiIxDds6j9wD3lt9vD-kptWl6bUft29O6Z0cTNgBQV6t76\/s1700-nu-rw-lo-l85-e365\/npm-apex.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.<\/p>\n<p>\u00abThe tools delivered information-stealing malware and backdoors for macOS and Windows machines,\u00bb Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic <a href=\"https:\/\/www.elastic.co\/security-labs\/threat-command\/apex-accelerator-malicious-npm-packages\" target=\"_blank\">said<\/a>. \u00abThe operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings.\u00bb<\/p>\n<p>The scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups and founders. It&#8217;s being tracked under the moniker <strong>REF8801<\/strong>. The names of the npm packages, each of which targets both Windows and macOS machines, are listed below &#8211;<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/socket.dev\/npm\/package\/@apexacc\/cli\" target=\"_blank\">@apexacc\/cli<\/a><\/strong> (Apex Copilot CLI \u2014 AI advisor for Web3 founders) &#8211; <\/li>\n<li><strong><a href=\"https:\/\/socket.dev\/npm\/package\/@apexacc\/audit\" target=\"_blank\">@apexacc\/audit<\/a><\/strong> (Web3 Security Scanner \u2014 18 tools for DYOR and smart contract auditing)<\/li>\n<\/ul>\n<p>While both the packages and their associated GitHub repositories are no longer accessible, \u00ab@apexacc\/cli\u00bb was advertised as an \u00abAI advisor for Web3 founders\u00bb that&#8217;s powered by Claude Fable 5 and Gemini 2.5 Flash.<\/p>\n<p>\u00ab@apexacc\/audit,\u00bb on the other hand, claimed to be a Model Context Protocol (MCP) server exposing 18 security tools for scanning tokens, wallets, and smart contracts. Both packages were published by an npm user named \u00abapexaccelerator\u00bb and linked to a GitHub account called \u00ab<a href=\"https:\/\/github.com\/apexaccs\" target=\"_blank\">apexaccs<\/a>\u00bb and an entity referred to as the Apex Foundation.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-agent-methods-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh-69Sxi6ukfnlM_EpqEB_hRVymcXAcWTNAJetA9huKutPZuG0OOBUvByDCtP_HokC-gM-AzjX0ZhgneUFVzjCyIduRINFj6Yf0JXRFE17_z82UioyT9eoxH2-XQDoD_hInCxc8V2bQrmtnMN-GUR63bseKn7pLRISqlvUJlfuJq8pgCL-Fot7sQDas9D05\/s728-nu-rw-lo-l85-e365\/nudge-3-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Interestingly, the campaign itself is not new. In late July 2026, SafeDep detailed three other npm packages linked to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS) family &#8211;<\/p>\n<p><a name=\"more\"\/><\/p>\n<ul>\n<li><strong>@apexfdn\/apex<\/strong><\/li>\n<li><strong>@copilot-mcp\/apex<\/strong>, which features the same package description as \u00ab@apexacc\/cli\u00bb<\/li>\n<li><strong><a href=\"https:\/\/socket.dev\/npm\/package\/@apexfdn\/copilot-mcp\" target=\"_blank\">@apexfdn\/copilot-mcp<\/a><\/strong>, which claims to be an Apex Copilot and MCP server for \u00abportfolio diligence and operator tools\u00bb<\/li>\n<\/ul>\n<p>Artifacts captured by Socket show that the Apex Foundation has been linked to at least two distinct domains since April 2026<\/p>\n<ul>\n<li><strong>apexaccs[.]org<\/strong><\/li>\n<li><strong>apexfdn[.]xyz<\/strong><\/li>\n<\/ul>\n<p>According to <a href=\"https:\/\/web.archive.org\/web\/20260318075933\/https:\/\/apexfdn.xyz\/\" target=\"_blank\">Internet Archive snapshots<\/a> dating back to March 19, 2026, the foundation states: \u00abThe Apex Foundation offers $235,000 investments, grants, and partnerships, and connects projects with VCs, angels, and private equity if they don&#8217;t meet our criteria.\u00bb<\/p>\n<p>Posts shared on X show the accelerator approaching developers of <a href=\"https:\/\/x.com\/hialex_sol\/status\/2099575319002800415\" target=\"_blank\">cryptocurrency wallets<\/a> and <a href=\"https:\/\/x.com\/thegreatola\/status\/2109393608906588531\" target=\"_blank\">market intelligence tools<\/a> for traders with offers of direct investment and instructions to run their due diligence tool (\u00ab@apexacc\/cli\u00bb). In the case of the latter, the npm package has been found to drop an encrypted malware loader disguised as an Apple app (\u00abcom.apple.system.loader\u00bb).<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg9gwi26P29rXFTaY2uTyawtWiugTCe_z2aAGx5-iAb4s62kxSnMRfm-D555amxKvjvx7rAYHJua2Y0SKT175TgNXMVwu98oeuq9cgUhQd_cQFWPYdLwLCzYgv7ixPFG9XUB5aCFxTOBEB3BCjKea5M3iWof2LSznKF97TQDxCaFyX8OXjPvKPNyaz3pCDO\/s1700-nu-rw-lo-l85-e365\/apex.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg9gwi26P29rXFTaY2uTyawtWiugTCe_z2aAGx5-iAb4s62kxSnMRfm-D555amxKvjvx7rAYHJua2Y0SKT175TgNXMVwu98oeuq9cgUhQd_cQFWPYdLwLCzYgv7ixPFG9XUB5aCFxTOBEB3BCjKea5M3iWof2LSznKF97TQDxCaFyX8OXjPvKPNyaz3pCDO\/s1700-nu-rw-lo-l85-e365\/apex.jpg\" alt=\"\" border=\"0\" data-original-height=\"618\" data-original-width=\"1011\"\/><\/a><\/div>\n<p>\u00abThe group also sought to build credibility through its presence at <a href=\"https:\/\/www.token2049.com\/\" target=\"_blank\">TOKEN2049<\/a> in Singapore and other in-person events it has hosted in the past,\u00bb Elastic said. \u00abThe group attempts to manufacture legitimacy by appearing at widely attended conferences, indirectly lending credibility to the project.\u00bb<\/p>\n<p>Once installed, neither of the npm packages provides the promised functionality. The 18 security tools part of the @apexacc\/audit package generate fabricated findings, while @apexacc\/cli&#8217;s scoring test returns an unsupported assessment of a fictitious project.<\/p>\n<p>Instead, their primary responsibility is to propagate a macOS backdoor called CloudSyncD and a custom Windows information stealer that exfiltrates data through Telegram. The platform-specific executables are retrieved from the projects&#8217; GitHub releases.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjU5FnJ5j3mFUN6Ljl5d7UEuOX7NH7xP3r18htPHCxRDqgTDaX_AnodfCXDClHkm6YNIcYqAZms4zaLvqp1OxjUrBqrMR257CFl3K-6IBx55YY1iBzmj2Q6wMMITkI1AC9RbUIOasVdosmLmdsdcazUZVz2C77PhyjjBM0u3vTwryABRU1S7lC1u3GVh4pc\/s1700-nu-rw-lo-l85-e365\/telegram.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjU5FnJ5j3mFUN6Ljl5d7UEuOX7NH7xP3r18htPHCxRDqgTDaX_AnodfCXDClHkm6YNIcYqAZms4zaLvqp1OxjUrBqrMR257CFl3K-6IBx55YY1iBzmj2Q6wMMITkI1AC9RbUIOasVdosmLmdsdcazUZVz2C77PhyjjBM0u3vTwryABRU1S7lC1u3GVh4pc\/s1700-nu-rw-lo-l85-e365\/telegram.png\" alt=\"\" border=\"0\" data-original-height=\"906\" data-original-width=\"1281\"\/><\/a><\/div>\n<p>Both packages implement a distinct verification path for Windows and macOS by sending an HTTP POST request to \u00abwin32\u00bb or \u00abdarwin\u00bb to \u00abvrf.apexaccs[.]org\/api\/v1\/vrf\u00bb to initiate the appropriate next stage. The Windows and macOS infection chains are as follows &#8211;<\/p>\n<p>Windows &#8211;<\/p>\n<ul>\n<li>The malware retrieves a Base64-encoded PowerShell command, which reaches out to another endpoint (\u00ab0auth-chromium[.]com\/APIService\u00bb) to fetch a second PowerShell script (\u00abdrop.ps1\u00bb) that downloads an executable (\u00abbludness.exe\u00bb) from \u00abehegisnightmare[.]icu\u00bb and launches it in a hidden window.<\/li>\n<li>The PyInstaller executable is a Python loader that checks if it already has administrator privileges and, if so, downloads the next stage from \u00abehegisnightmare[.]icu,\u00bb saves it as \u00ab%TEMP%\\exegis.exe,\u00bb and launches it. If not, it attempts to bypass User Account Control (UAC) using <a href=\"https:\/\/github.com\/hfiref0x\/UACME\/blob\/3f1885cab0e3a277db0cadc83d0a782bafa9e4cd\/Source\/Akagi\/methods\/tyranid.c#L435\" target=\"_blank\">UACME&#8217;s ucmDebugObjectMethod()<\/a>.<\/li>\n<li>The \u00abexegis.exe\u00bb binary is another PyInstaller executable that collects system metadata, running processes, and performs anti-virtual-machine (anti-VM) checks before decrypting and launching a bundled loader as \u00ab%TEMP%\\updater_loader.exe.\u00bb<\/li>\n<li>The Golang executable patches Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), <a href=\"https:\/\/cymulate.com\/blog\/extracting-syscalls-from-a-suspended-process\/\" target=\"_blank\">unhooks \u00abntdll.dll\u00bb<\/a> to blind endpoint security tools, and loads the next-stage shellcode into its own memory.<\/li>\n<li>The shellcode is a native information stealer that examines for signs of a prior infection and then harvests system information, clipboard text, process listings, Wi-Fi profile names, screenshots, and data from wallets, browser extensions, messengers, remote-access and file transfer protocol (FTP) applications, virtual private network (VPN) clients, browsers (Google Chrome, Microsoft Edge, Mozilla Firefox, and Yandex), and game clients. The stealer can also bypass Chrome&#8217;s app-bound encryption (ABE) protections to extract saved passwords, session cookies, browsing history, download records, and profile metadata. The collected data is exfiltrated through Telegram.<\/li>\n<\/ul>\n<p>macOS &#8211;<\/p>\n<ul>\n<li>The malware downloads a remotely hosted bash script and executes it on the machine.<\/li>\n<li>The shell script downloads a GZIP-compressed archive from \u00abverify.apexfdn[.]xyz\/unix\/,\u00bb saves it as \u00abpackage.tar.gz\u00bb in a temporary directory, and extracts its contents.<\/li>\n<li>The archive contains a dropper for CloudSyncD, which first phishes the victim&#8217;s system login password using a fake authorization prompt and then uses it to launch an embedded payload with sudo privileges. The payload performs host discovery, collects hardware and operating-system details, and then contacts an external server (\u00abccmihr[.]com\u00bb) to transmit the data and receive further tasks that allow the malware to download and run additional payloads.<\/li>\n<\/ul>\n<p>It&#8217;s worth noting that CloudSyncD was <a href=\"https:\/\/www.jamf.com\/blog\/cloudsyncd-macos-backdoor-fake-zoom-installer\/\" target=\"_blank\">first documented<\/a> by Jamf Threat Labs late last month, detailing its propagation via a fake Zoom installer. The malware was detected in the wild in mid-September 2026.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>\u00abIts behaviors illustrate how macOS malware continues to move toward native implementations, string protection, and execution paths that attempt to avoid writing payloads to disk, while still depending on the oldest technique available: asking the user for their password,\u00bb Jamf said.<\/p>\n<p>Besides deploying a stealer and backdoor depending upon the infected operating system, the packages are capable of intercepting and redirecting OpenRouter large language model (LLM) traffic, as well as registering an MCP server under their control in the victim&#8217;s agent configuration.<\/p>\n<p>\u00abThese changes allow the attacker-controlled API to receive the prompts, conversation history, code snippets, and tool outputs included in the agent&#8217;s LLM requests,\u00bb Elastic researchers explained.<\/p>\n<p>\u00abThe attacker&#8217;s MCP server can also supply instructions that are added to the agent&#8217;s prompt, along with tool names, descriptions, and accepted inputs that help the model decide which tools to invoke and how to use them. Together, these mechanisms give the attacker visibility into the submitted data and a way to influence the agent&#8217;s subsequent actions.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI)&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3604,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3836,683,150,333,42,39,35,262,1267,3118],"class_list":["post-3603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-accelerator","tag-agent","tag-fake","tag-hijack","tag-malware","tag-npm","tag-packages","tag-spread","tag-traffic","tag-web3"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3603"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3603\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3604"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}