Fake Web3 accelerator uses npm packages to infect developers
Fake accelerator delivers malware through npm
Elastic Security Labs has identified REF8801, an operation posing as a Web3 venture capital accelerator named Apex Accelerator. The group used malicious npm packages to target cryptocurrency startups and founders with offers of free artificial-intelligence credits, coding tools and security audits.
The two packages, @apexacc/cli and @apexacc/audit, targeted both Windows and macOS. Published by the npm user “apexaccelerator,” they were linked to a GitHub account called “apexaccs” and an entity presented as the Apex Foundation. The packages and associated GitHub repositories are no longer accessible.
@apexacc/cli was promoted as an AI adviser for Web3 founders powered by Claude Fable 5 and Gemini 2.5 Flash. @apexacc/audit claimed to be a Model Context Protocol server with 18 tools for token, wallet and smart-contract scanning. Neither package provided the functionality it advertised: the audit package generated fabricated findings, while the CLI returned an unsupported assessment of a fictitious project.
Windows stealer and macOS backdoor
Instead, the packages delivered a custom Windows information stealer and the CloudSyncD macOS backdoor. Each used an operating-system-specific verification route, posting “win32” or “darwin” to the group’s verification endpoint before retrieving further stages from GitHub releases and other infrastructure.
On Windows, the infection chain used PowerShell, PyInstaller executables and a Golang loader. Elastic said the chain attempted UAC bypass with UACME’s ucmDebugObjectMethod(), patched AMSI and ETW, and unhooked ntdll.dll. The final stealer collected system and process information, clipboard content, screenshots, Wi-Fi profile names and data from wallets, browser extensions, messengers, VPN clients, browsers and other applications.
The Windows malware could also bypass Chrome app-bound encryption to collect saved passwords, cookies, browsing history, downloads and profile metadata. It exfiltrated collected data through Telegram.
On macOS, a downloaded shell script retrieved an archive containing a CloudSyncD dropper. The dropper displayed a fake authorization prompt to obtain the victim’s system password, then used it to launch an embedded payload with sudo privileges. That payload gathered host, hardware and operating-system details, contacted an external server and could receive tasks to download and run additional payloads.
AI agent data is also in scope
The operation extended beyond endpoint malware. Elastic found that the packages could intercept and redirect OpenRouter large language model traffic and register an attacker-controlled MCP server in the victim’s agent configuration. This could expose prompts, conversation history, code snippets and tool outputs included in model requests.
An attacker-controlled MCP server can also provide instructions, tool names, descriptions and accepted inputs that are added to an agent’s context. Elastic noted that this gives the operator both visibility into submitted information and a way to influence an agent’s subsequent actions.
SafeDep linked three other packages to the same operation in late July 2026, including packages associated with Atomic Stealer on macOS. For businesses, the incident makes a practical case for validating package publishers, reviewing dependencies and isolating AI-agent credentials and traffic before third-party developer tools are allowed into production workflows.