Fake Web3 Accelerator Spreads Malware via Malicious npm Packages
Attackers target crypto developers using fraudulent AI tools to hijack sensitive agent traffic.
1Sophisticated Social Engineering Campaign
The threat actor known as REF8801 poses as Apex Accelerator to deceive cryptocurrency founders. By offering free AI credits for Claude and Gemini, they entice developers to install malicious npm packages. This campaign leverages a facade of legitimacy, including fake security audits and presence at major industry conferences like TOKEN2049.
2Malicious npm Package Mechanics
Attackers published packages like @apexacc/cli and @apexacc/audit to distribute information stealers. Once installed, these tools fail to provide promised functionality, instead executing platform-specific payloads. The packages initiate HTTP POST requests to a command-and-control server, identifying the operating system to deploy either CloudSyncD for macOS or custom Windows stealers.
3Hijacking AI Agent Traffic
Beyond stealing local data, the malware intercepts LLM requests by registering a malicious Model Context Protocol server. This allows attackers to capture conversation history, code snippets, and tool outputs. By manipulating the agent's configuration, they can inject instructions and influence model behavior, effectively compromising the integrity of the user's AI workflows.
4Fabricated Security Audit Findings
The @apexacc/audit package claims to offer eighteen security tools for scanning smart contracts and digital wallets. In reality, these tools generate entirely fabricated security findings to build false trust with victims. This deceptive mechanism ensures developers remain unaware of the underlying compromise while the malware exfiltrates sensitive information through Telegram.
5Historical Context and Persistence
This operation is not a new development, as researchers identified related activity dating back to July 2026. Previous iterations of the campaign involved distributing Atomic Stealer variants. The Apex Foundation, the entity behind the scheme, has maintained a digital footprint since April 2026, including promises of significant investment grants to lure targets.
6Technical Infection Chain Details
The malware uses an encrypted loader disguised as a system file to bypass basic detection. On macOS, it utilizes the CloudSyncD backdoor, which relies on traditional user password prompts to gain execution privileges. These native implementations demonstrate a shift toward sophisticated execution paths that attempt to avoid writing suspicious payloads to disk.
7Attribution and Language Clues
While the identity of the operators remains unconfirmed, investigators discovered Russian-language comments within the source code commit history. However, these artifacts are insufficient to definitively attribute the campaign to a specific group or nation-state. The operation continues to evolve, utilizing diverse infrastructure to maintain its presence within the developer ecosystem.
8Implications for AI Security
This incident highlights the growing risks associated with integrating third-party AI tools into development environments. As AI agents gain access to sensitive systems, they become prime targets for supply chain attacks. Organizations must prioritize assessing threat readiness and strengthening visibility into agent configurations to mitigate potential insider risks and data breaches.
Original article: The Hacker News — Fake Web3 Accelerator Spreads Malware via Malicious npm Packages