{
	"id": "2b433237-13a6-4cab-a371-3f306e46dd88",
	"created_at": "2026-10-24T02:14:24.689456Z",
	"updated_at": "2026-10-24T02:22:01.960182Z",
	"deleted_at": null,
	"sha1_hash": "4f413ab51db6caf94c6f4a5b43bb27e7e09f03f5",
	"title": "Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 1381161,
	"plain_text": "https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html\n\nFake Web3 Accelerator Uses npm Packages to Spread Malware\n\nand Hijack AI Agent Traffic\n\nBy The Hacker News\n\nPublished: 2026-10-19 · Archived: 2026-10-24 02:01:06 UTC\n\nA fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS\n\nsystems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for\n\nAnthropic Claude and Google Gemini, coding tools, and security audits.\n\n\"The tools delivered information-stealing malware and backdoors for macOS and Windows machines,\" Elastic\n\nSecurity Labs researchers Jia Yu Chan and Daniel Stepanic said. \"The operation also repackaged a legitimate\n\ncoding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated\n\nsecurity findings.\"\n\nThe scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups\n\nand founders. It's being tracked under the moniker REF8801. The names of the npm packages, each of which\n\ntargets both Windows and macOS machines, are listed below -\n\n@apexacc/cli (Apex Copilot CLI — AI advisor for Web3 founders) -\n\n@apexacc/audit (Web3 Security Scanner — 18 tools for DYOR and smart contract auditing)\n\nWhile both the packages and their associated GitHub repositories are no longer accessible, \"@apexacc/cli\" was\n\nadvertised as an \"AI advisor for Web3 founders\" that's powered by Claude Fable 5 and Gemini 2.5 Flash.\n\nPage 1 of 5\n\nhttps://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html\n\n\"@apexacc/audit,\" on the other hand, claimed to be a Model Context Protocol (MCP) server exposing 18 security\n\ntools for scanning tokens, wallets, and smart contracts. Both packages were published by an npm user named\n\n\"apexaccelerator\" and linked to a GitHub account called \"apexaccs\" and an entity referred to as the Apex\n\nFoundation.\n\nIt's unclear who is behind the operation, but Elastic Security Labs said it spotted Russian-language comments in\n\nthe source code commit history. However, these clues alone are not sufficient to definitively establish their identity\n\nor origins.\n\nInterestingly, the campaign itself is not new. In late July 2026, SafeDep detailed three other npm packages linked\n\nto the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS)\n\nfamily -\n\n@apexfdn/apex\n\n@copilot-mcp/apex, which features the same package description as \"@apexacc/cli\"\n\n@apexfdn/copilot-mcp, which claims to be an Apex Copilot and MCP server for \"portfolio diligence and\n\noperator tools\"\n\nArtifacts captured by Socket show that the Apex Foundation has been linked to at least two distinct domains since\n\nApril 2026 -\n\napexaccs[.]org\n\napexfdn[.]xyz\n\nAccording to Internet Archive snapshots dating back to March 19, 2026, the website claimed that \"the Apex\n\nFoundation offers $235,000 investments, grants, and partnerships, and connects projects with VCs, angels, and\n\nprivate equity if they don't meet our criteria.\"\n\nPosts shared on X show the accelerator approaching developers of cryptocurrency wallets and market intelligence\n\ntools for traders with offers of direct investment and instructions to run their due diligence tool (\"@apexacc/cli\").\n\nIn the case of the latter, the npm package has been found to drop an encrypted malware loader disguised as an\n\nApple app (\"com.apple.system.loader\").\n\nPage 2 of 5\n\nhttps://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html\n\n\"The group also sought to build credibility through its presence at TOKEN2049 in Singapore and other in-person\n\nevents it has hosted in the past,\" Elastic said. \"The group attempts to manufacture legitimacy by appearing at\n\nwidely attended conferences, indirectly lending credibility to the project.\"\n\nOnce installed, neither of the npm packages provides the promised functionality. The 18 security tools part of the\n\n@apexacc/audit package generate fabricated findings, while @apexacc/cli's scoring test returns an unsupported\n\nassessment of a fictitious project.\n\nInstead, their primary responsibility is to propagate a macOS backdoor called CloudSyncD and a custom\n\nWindows information stealer that exfiltrates data through Telegram. The platform-specific executables are\n\nretrieved from the projects' GitHub releases.\n\nPage 3 of 5\n\nhttps://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html\n\nBoth packages implement a distinct verification path for Windows and macOS by sending an HTTP POST request\n\ncontaining \"win32\" or \"darwin\" to \"vrf.apexaccs[.]org/api/v1/vrf\" to initiate the appropriate next stage. The\n\nWindows and macOS infection chains are as follows -\n\nWindows -\n\nThe malware retrieves a Base64-encoded PowerShell command, which reaches out to another endpoint\n\n(\"0auth-chromium[.]com/APIService\") to fetch a second PowerShell script (\"drop.ps1\") that downloads an\n\nexecutable (\"bludness.exe\") from \"ehegisnightmare[.]icu\" and launches it in a hidden window.\n\nThe PyInstaller executable is a Python loader that checks if it already has administrator privileges and, if\n\nso, downloads the next stage from \"ehegisnightmare[.]icu,\" saves it as \"%TEMP%\\exegis.exe,\" and\n\nlaunches it. If not, it attempts to bypass User Account Control (UAC) using UACME's\n\nucmDebugObjectMethod().\n\nThe \"exegis.exe\" binary is another PyInstaller executable that collects system metadata, running processes,\n\nand performs anti-virtual-machine (anti-VM) checks before decrypting and launching a bundled loader as\n\n\"%TEMP%\\updater_loader.exe.\"\n\nThe Golang executable patches Antimalware Scan Interface (AMSI) and Event Tracing for Windows\n\n(ETW), unhooks \"ntdll.dll\" to blind endpoint security tools, and loads the next-stage shellcode into its own\n\nmemory.\n\nThe shellcode is a native information stealer that examines for signs of a prior infection and then harvests\n\nsystem information, clipboard text, process listings, Wi-Fi profile names, screenshots, and data from\n\nwallets, browser extensions, messengers, remote-access and file transfer protocol (FTP) applications,\n\nPage 4 of 5\n\nhttps://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html\n\nvirtual private network (VPN) clients, browsers (Google Chrome, Microsoft Edge, Mozilla Firefox, and\n\nYandex), and game clients. The stealer can also bypass Chrome's app-bound encryption (ABE) protections\n\nto extract saved passwords, session cookies, browsing history, download records, and profile metadata. The\n\ncollected data is exfiltrated through Telegram.\n\nmacOS -\n\nThe malware downloads a remotely hosted bash script and executes it on the machine.\n\nThe shell script downloads a GZIP-compressed archive from \"verify.apexfdn[.]xyz/unix/,\" saves it as\n\n\"package.tar.gz\" in a temporary directory, and extracts its contents.\n\nThe archive contains a dropper for CloudSyncD, which first phishes the victim's system login password\n\nusing a fake authorization prompt and then uses it to launch an embedded payload with sudo privileges.\n\nThe payload performs host discovery, collects hardware and operating-system details, and then contacts an\n\nexternal server (\"ccmihr[.]com\") to transmit the data and receive further tasks that allow the malware to\n\ndownload and run additional payloads.\n\nIt's worth noting that CloudSyncD was first documented by Jamf Threat Labs late last month, detailing its\n\npropagation via a fake Zoom installer. The malware was detected in the wild in mid-September 2026.\n\n\"Its behaviors illustrate how macOS malware continues to move toward native implementations, string protection,\n\nand execution paths that attempt to avoid writing payloads to disk, while still depending on the oldest technique\n\navailable: asking the user for their password,\" Jamf said.\n\nBesides deploying a stealer and backdoor depending upon the infected operating system, the packages are capable\n\nof intercepting and redirecting OpenRouter large language model (LLM) traffic, as well as registering an MCP\n\nserver under their control in the victim's agent configuration.\n\n\"These changes allow the attacker-controlled API to receive the prompts, conversation history, code snippets, and\n\ntool outputs included in the agent's LLM requests,\" Elastic researchers explained.\n\n\"The attacker's MCP server can also supply instructions that are added to the agent's prompt, along with tool\n\nnames, descriptions, and accepted inputs that help the model decide which tools to invoke and how to use them.\n\nTogether, these mechanisms give the attacker visibility into the submitted data and a way to influence the agent's\n\nsubsequent actions.\"\n\nFound this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content\n\nwe post.\n\nSource: https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html\n\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html"
	],
	"report_names": [
		"fake-web3-accelerator-uses-npm-packages.html"
	],
	"threat_actors": [],
	"ts_created_at": 1792808064,
	"ts_updated_at": 1792808521,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4f413ab51db6caf94c6f4a5b43bb27e7e09f03f5.pdf",
		"text": "https://archive.orkl.eu/4f413ab51db6caf94c6f4a5b43bb27e7e09f03f5.txt",
		"img": "https://archive.orkl.eu/4f413ab51db6caf94c6f4a5b43bb27e7e09f03f5.jpg"
	}
}