A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.
“The tools delivered information-stealing malware and backdoors for macOS and Windows machines,” Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said. “The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings.”
The scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups and founders. It’s being tracked under the moniker REF8801. The names of the npm packages, each of which targets both Windows and macOS machines, are listed below –
- @apexacc/cli (Apex Copilot CLI — AI advisor for Web3 founders) –
- @apexacc/audit (Web3 Security Scanner — 18 tools for DYOR and smart contract auditing)
While both the packages and their associated GitHub repositories are no longer accessible, “@apexacc/cli” was advertised as an “AI advisor for Web3 founders” that’s powered by Claude Fable 5 and Gemini 2.5 Flash.
“@apexacc/audit,” on the other hand, claimed to be a Model Context Protocol (MCP) server exposing 18 security tools for scanning tokens, wallets, and smart contracts. Both packages were published by an npm user named “apexaccelerator” and linked to a GitHub account called “apexaccs” and an entity referred to as the Apex Foundation.
It’s unclear who is behind the operation, but Elastic Security Labs said it spotted Russian-language comments in the source code commit history. However, these clues alone are not sufficient to definitively establish their identity or origins.
Interestingly, the campaign itself is not new. In late July 2026, SafeDep detailed three other npm packages linked to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS) family –
- @apexfdn/apex
- @copilot-mcp/apex, which features the same package description as “@apexacc/cli”
- @apexfdn/copilot-mcp, which claims to be an Apex Copilot and MCP server for “portfolio diligence and operator tools”
Artifacts captured by Socket show that the Apex Foundation has been linked to at least two distinct domains since April 2026
- apexaccs[.]org
- apexfdn[.]xyz
According to Internet Archive snapshots dating back to March 19, 2026, the foundation states: “The Apex Foundation offers $235,000 investments, grants, and partnerships, and connects projects with VCs, angels, and private equity if they don’t meet our criteria.”
Posts shared on X show the accelerator approaching developers of cryptocurrency wallets and market intelligence tools for traders with offers of direct investment and instructions to run their due diligence tool (“@apexacc/cli”). In the case of the latter, the npm package has been found to drop an encrypted malware loader disguised as an Apple app (“com.apple.system.loader”).
“The group also sought to build credibility through its presence at TOKEN2049 in Singapore and other in-person events it has hosted in the past,” Elastic said. “The group attempts to manufacture legitimacy by appearing at widely attended conferences, indirectly lending credibility to the project.”
Once installed, neither of the npm packages provides the promised functionality. The 18 security tools part of the @apexacc/audit package generate fabricated findings, while @apexacc/cli’s scoring test returns an unsupported assessment of a fictitious project.
Instead, their primary responsibility is to propagate a macOS backdoor called CloudSyncD and a custom Windows information stealer that exfiltrates data through Telegram. The platform-specific executables are retrieved from the projects’ GitHub releases.
Both packages implement a distinct verification path for Windows and macOS by sending an HTTP POST request to “win32” or “darwin” to “vrf.apexaccs[.]org/api/v1/vrf” to initiate the appropriate next stage. The Windows and macOS infection chains are as follows –
Windows –
- The malware retrieves a Base64-encoded PowerShell command, which reaches out to another endpoint (“0auth-chromium[.]com/APIService”) to fetch a second PowerShell script (“drop.ps1”) that downloads an executable (“bludness.exe”) from “ehegisnightmare[.]icu” and launches it in a hidden window.
- The PyInstaller executable is a Python loader that checks if it already has administrator privileges and, if so, downloads the next stage from “ehegisnightmare[.]icu,” saves it as “%TEMP%exegis.exe,” and launches it. If not, it attempts to bypass User Account Control (UAC) using UACME’s ucmDebugObjectMethod().
- The “exegis.exe” binary is another PyInstaller executable that collects system metadata, running processes, and performs anti-virtual-machine (anti-VM) checks before decrypting and launching a bundled loader as “%TEMP%updater_loader.exe.”
- The Golang executable patches Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), unhooks “ntdll.dll” to blind endpoint security tools, and loads the next-stage shellcode into its own memory.
- The shellcode is a native information stealer that examines for signs of a prior infection and then harvests system information, clipboard text, process listings, Wi-Fi profile names, screenshots, and data from wallets, browser extensions, messengers, remote-access and file transfer protocol (FTP) applications, virtual private network (VPN) clients, browsers (Google Chrome, Microsoft Edge, Mozilla Firefox, and Yandex), and game clients. The stealer can also bypass Chrome’s app-bound encryption (ABE) protections to extract saved passwords, session cookies, browsing history, download records, and profile metadata. The collected data is exfiltrated through Telegram.
macOS –
- The malware downloads a remotely hosted bash script and executes it on the machine.
- The shell script downloads a GZIP-compressed archive from “verify.apexfdn[.]xyz/unix/,” saves it as “package.tar.gz” in a temporary directory, and extracts its contents.
- The archive contains a dropper for CloudSyncD, which first phishes the victim’s system login password using a fake authorization prompt and then uses it to launch an embedded payload with sudo privileges. The payload performs host discovery, collects hardware and operating-system details, and then contacts an external server (“ccmihr[.]com”) to transmit the data and receive further tasks that allow the malware to download and run additional payloads.
It’s worth noting that CloudSyncD was first documented by Jamf Threat Labs late last month, detailing its propagation via a fake Zoom installer. The malware was detected in the wild in mid-September 2026.
“Its behaviors illustrate how macOS malware continues to move toward native implementations, string protection, and execution paths that attempt to avoid writing payloads to disk, while still depending on the oldest technique available: asking the user for their password,” Jamf said.
Besides deploying a stealer and backdoor depending upon the infected operating system, the packages are capable of intercepting and redirecting OpenRouter large language model (LLM) traffic, as well as registering an MCP server under their control in the victim’s agent configuration.
“These changes allow the attacker-controlled API to receive the prompts, conversation history, code snippets, and tool outputs included in the agent’s LLM requests,” Elastic researchers explained.
“The attacker’s MCP server can also supply instructions that are added to the agent’s prompt, along with tool names, descriptions, and accepted inputs that help the model decide which tools to invoke and how to use them. Together, these mechanisms give the attacker visibility into the submitted data and a way to influence the agent’s subsequent actions.”
