Fake Web3 Accelerator Uses npm Packages to Deliver Malware and Hijack AI-Agent Traffic
Summary
A fake Web3 accelerator used malicious npm packages to deliver Windows and macOS malware and redirect AI-agent traffic, exposing prompts, conversation history, code, and tool outputs to attacker-controlled services.
Key points
- The REF8801 operation posed as Apex Accelerator, offering AI credits, coding tools, and security audits to cryptocurrency startups and founders.
- The packages @apexacc/cli and @apexacc/audit delivered a macOS backdoor called CloudSyncD and a custom Windows information stealer that exfiltrates data through Telegram.
- The packages' promised AI and audit features did not work as advertised; the audit tools generated fabricated security findings.
- The packages could redirect OpenRouter LLM requests and register an attacker-controlled MCP server in victims' agent configurations, exposing prompts, conversation history, code snippets, and tool outputs and potentially influencing agent actions.
- The packages initiated platform-specific verification through vrf[.]apexaccs[.]org/api/v1/vrf. The article says the npm packages and associated GitHub repositories are no longer accessible.
- Elastic Security Labs could not identify the operators; Russian-language comments in source-code commit history were not sufficient to establish their identity or origin.
Article Details
- Event Type
- Malicious npm supply-chain operation impersonating a Web3 accelerator and distributing malware while intercepting AI-agent traffic.
- Impact
- Packages published under the npm user apexaccelerator delivered the CloudSyncD macOS backdoor and a custom Windows information stealer, and could redirect OpenRouter LLM requests to attacker-controlled services. This exposed prompts, conversation history, code snippets, and tool outputs and allowed attacker-controlled MCP instructions to influence agent behavior. The packages also generated fabricated security-audit findings. The article reports the packages and associated GitHub repositories are no longer accessible.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | vrf[.]apexaccs[.]org | Reportedly attacker-controlled verification endpoint contacted by the malicious npm packages to initiate the platform-specific infection chain. |
People
Threat Actors
Malware
Atomic macOS Stealer (AMOS)to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS) family -Atomic Stealerpackages linked to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS) family -CloudSyncDInstead, their primary responsibility is to propagate a macOS backdoor called CloudSyncD and a custom Windows information stealer that exfiltrates data through Telegram. The platform-specific executables are retrieved
Products
Claudemalicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.Google Geminiunder the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.OpenRouterdepending upon the infected operating system, the packages are capable of intercepting and redirecting OpenRouter large language model (LLM) traffic, as well as registering an MCP server under their control in the
Tools
@apexacc/audit"@apexacc/audit," on the other hand, claimed to be a Model Context Protocol (MCP) server exposing 18 security tools for scanning tokens, wallets, and smart contracts. Both packages were published by an npm user named@apexacc/cliWhile both the packages and their associated GitHub repositories are no longer accessible, "@apexacc/cli" was advertised as an "AI advisor for Web3 founders" that's powered by Claude Fable 5 and Gemini 2.5 Flash.