Fake Web3 Accelerator

Your npm install might have handed a stranger your browser cookies, your wallet files, and a persistent backdoor, because researchers just documented a fake Web3 accelerator that's been pushing malicious packages under the promise of free Anthropic and Google Gemini credits, coding tools, and security audits, and the whole operation was built to look legitimate enough that founders ran it themselves.

The scheme poses as a venture capital accelerator called Apex Accelerator. Elastic Security Labs tracks it as REF8801, and the package names are already public.

What Makes This Fake Web3 Accelerator Malware Campaign Dangerous

Most npm attacks rely on typosquatting or dependency confusion. This one relies on flattery.

The operators approached crypto wallet developers and trading intelligence tool builders directly on X, offering investment and telling targets to run the accelerator's due diligence tool. No exploit needed. The victim installs it.

That's a social engineering play wrapped around a supply chain payload.

Both packages and their GitHub repositories are no longer accessible. That doesn't help anyone who already installed them.

The Packages Behind the Apex Accelerator Scam

Two names anchor the current wave, and both claimed to do something a crypto founder would genuinely want.

@apexacc/cli

Advertised as an AI advisor for Web3 founders, powered by Claude Fable 5 and Gemini 2.5 Flash.

What it actually does is drop an encrypted malware loader disguised as an Apple app, named com.apple.system.loader.

Its scoring test returns an unsupported assessment of a fictitious project. That's the tell nobody caught.

@apexacc/audit

Claimed to be a Model Context Protocol server exposing 18 security tools for scanning tokens, wallets, and smart contracts.

The 18 tools generate fabricated findings. Not broken findings. Invented ones.

Fake output is a smart cover, because a security tool that reports nothing wrong looks like a clean audit.

The Earlier Wave

This campaign isn't new. In late July 2026, SafeDep documented three other npm packages tied to the same operation, distributing a macOS stealer from the Atomic Stealer family:

• @apexfdn/apex
• @copilot-mcp/apex
• @apexfdn/copilot-mcp

How the Operators Manufactured Credibility

The infrastructure tells a story of sustained effort, not an overnight scam.

Internet Archive snapshots dating to March 19, 2026 show the site claiming the Apex Foundation offers $235,000 investments, grants, and partnerships, and connects projects with VCs, angels, and private equity if they don't meet its criteria.

Socket captured artifacts linking the Apex Foundation to at least two domains since April 2026.

Then there's the conference presence. The group appeared at TOKEN2049 in Singapore and hosted other in-person events. Elastic's assessment is blunt: the group manufactures legitimacy by showing up at widely attended conferences, indirectly borrowing credibility from the room.

Elastic Security Labs noted Russian-language comments in the source code commit history. They stopped short of attributing the operation, and that restraint is appropriate. Commit comments aren't an identity.

What Happens Once You Install It

Neither package delivers the functionality it advertises. Both are front ends for platform-specific payloads pulled from the projects' GitHub releases.

Both packages also run a distinct verification step. They send an HTTP POST containing win32 or darwin to vrf.apexaccs[.]org/api/v1/vrf, which decides which chain runs next.

The Windows Chain

The sequence has four stages, and it's built to survive contact with endpoint security.

1. A Base64-encoded PowerShell command reaches out to 0auth-chromium[.]com/APIService and fetches a second script, drop.ps1.
2. That script downloads bludness.exe from ehegisnightmare[.]icu and launches it in a hidden window.
3. The PyInstaller loader checks for admin rights. If it has them, it pulls the next stage and saves it as %TEMP%\exegis.exe. If it doesn't, it attempts UAC bypass using UACME's ucmDebugObjectMethod().
4. exegis.exe collects system metadata, enumerates processes, runs anti-VM checks, then decrypts and launches updater_loader.exe.

From there, a Golang executable patches AMSI and Event Tracing for Windows, unhooks ntdll.dll to blind endpoint tooling, and loads shellcode into its own memory.

What the Windows Stealer Takes

The shellcode checks for signs of a prior infection first, which tells you the operator expects repeat victims. Then it harvests:

• System information and clipboard text
• Process listings and Wi-Fi profile names
• Screenshots
• Wallet data and browser extension data
• Messenger, remote-access, FTP, and VPN client data
• Browser data from Chrome, Edge, Firefox, and Yandex
• Game client data

It also bypasses Chrome's app-bound encryption to extract saved passwords, session cookies, browsing history, download records, and profile metadata.

Exfiltration runs through Telegram.

The macOS Chain

The macOS path is shorter and relies on an older trick.

1. A remotely hosted bash script downloads and executes on the machine.
2. It pulls a GZIP archive from verify.apexfdn[.]xyz/unix/, saves it as package.tar.gz, and extracts it.
3. The archive holds a CloudSyncD dropper, which phishes the victim's login password with a fake authorization prompt.
4. With the password in hand, it launches the embedded payload with sudo privileges.
5. The payload does host discovery, collects hardware and OS details, contacts ccmihr[.]com, transmits the data, and receives further tasks.

CloudSyncD was first documented by Jamf Threat Labs in late September, spreading through a fake Zoom installer. It was detected in the wild in mid-September 2026.

Jamf's summary of the technique is worth quoting: the malware shows how macOS threats keep moving toward native implementations and string protection, while still depending on the oldest trick available, asking the user for their password.

The AI Angle Most Coverage Misses

Beyond the stealer and the backdoor, both packages can intercept and redirect OpenRouter LLM traffic. They also register an MCP server under the attacker's control inside the victim's agent configuration.

Elastic's researchers explained what that buys the operator. The attacker-controlled API receives the prompts, conversation history, code snippets, and tool outputs included in the agent's requests.

The attacker's MCP server can also supply instructions injected into the agent's prompt, along with tool names, descriptions, and accepted inputs that shape which tools the model invokes.

Read that as a whole. It's not just data theft. It's a position from which an attacker can influence what your coding agent does next.

For a founder running an AI coding assistant against a crypto codebase, that's a different order of problem than stolen cookies.

How to Check If You're Affected

Search your dependency trees and lockfiles for these names:

• @apexacc/cli
• @apexacc/audit
• @apexfdn/apex
• @copilot-mcp/apex
• @apexfdn/copilot-mcp

Then check network logs for the known infrastructure:

• vrf.apexaccs[.]org
• 0auth-chromium[.]com
• ehegisnightmare[.]icu
• verify.apexfdn[.]xyz
• ccmihr[.]com

On Windows, look for %TEMP%\exegis.exe and %TEMP%\updater_loader.exe. On macOS, look for com.apple.system.loader and check whether any unexpected authorization prompts appeared recently.

How to Respond If You Find It

• Treat it as a full compromise. This chain includes a stealer with Chrome ABE bypass and a backdoor with remote tasking. There's no partial cleanup.
• Revoke and rotate everything the machine could reach. Browser sessions, wallet keys, exchange API keys, SSH keys, cloud credentials, npm tokens, GitHub tokens.
• Move funds from any wallet whose keys touched an infected machine. Software cleanup doesn't undo key exposure.
• Audit your AI agent configuration. Check for MCP servers you didn't add. Review OpenRouter settings for endpoints you didn't configure.
• Rebuild rather than clean. Both chains establish persistence and reach into memory-resident shellcode.
• Review your Telegram-exfil exposure. Credentials sent this way don't leave obvious outbound connections in most network monitoring.

Why Crypto Founders Are the Target

The targeting isn't random. Crypto founders sit at an intersection that makes them unusually valuable.

They hold keys to real money. They run developer tooling with broad permissions. They're early adopters of AI coding agents, which means they'll install something promising AI credits without asking many questions. And they operate in a culture where moving fast on new tooling is a virtue.

Add the conference circuit, where trust gets established in person, and you have a population that's both high-value and highly reachable.

The free-credits hook is the sharpest part of the design. It's an offer that costs the target nothing to accept and requires no verification, which is exactly why people accept it.

FAQ

What is the Apex Accelerator malware campaign?

It's a supply chain operation tracked as REF8801 that poses as a Web3 venture capital accelerator. It distributes malicious npm packages disguised as AI advisor and smart contract audit tools, which install stealers and backdoors on Windows and macOS systems.

Which npm packages are involved?

The current wave uses @apexacc/cli and @apexacc/audit. An earlier wave documented in late July 2026 used @apexfdn/apex, @copilot-mcp/apex, and @apexfdn/copilot-mcp.

What does the malware steal?

On Windows, a custom stealer harvests system info, clipboard contents, screenshots, wallet data, browser passwords and cookies, session data, messenger and VPN client data, and more, exfiltrating through Telegram. On macOS, the CloudSyncD backdoor phishes the login password and establishes persistent remote tasking.

Does it affect both Windows and macOS?

Yes. The packages send a request containing win32 or darwin to a verification endpoint, which serves the matching infection chain for the host platform.

Who is behind the campaign?

Not established. Elastic Security Labs noted Russian-language comments in the source code commit history but said those clues alone aren't enough to determine identity or origin.

What should I do if I installed one of these packages?

Treat the machine as fully compromised. Rotate all credentials and keys it could reach, move funds from any wallet whose keys touched it, audit your AI agent and MCP configuration, and rebuild the system rather than attempting cleanup.

Source: The Hacker News