Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Fake Web3 Accelerator Uses npm Packages to Steal Data and Hijack AI Agents

A fake crypto accelerator is pushing malicious npm 'AI advisor' and 'audit' packages that drop stealers and backdoors on Windows and macOS, and reroute developers' AI agent traffic to the attackers.

4T4Tify Team4Tify
Oct 19, 2026·5 min read
Fake Web3 Accelerator Uses npm Packages to Steal Data and Hijack AI Agents

Fake Web3 "Accelerator" Ships Malicious npm Packages That Steal Data and Hijack AI Agent Traffic

A campaign posing as a Web3 venture accelerator has been luring crypto founders and developers into installing malicious npm packages. The packages are dressed up as free AI tooling and security audits, but they install information stealers and backdoors on Windows and macOS, and they quietly reroute the victim's AI coding-agent traffic through attacker-controlled infrastructure.

What happened

The operation, tracked as REF8801, presents itself as "Apex Accelerator", backed by an "Apex Foundation" that promises investment, grants and introductions to VCs. Since at least spring 2026 it has run its own web domains, contacted wallet and trading-tool developers on X with funding offers, and even appeared at industry events such as TOKEN2049 in Singapore to look credible.

The hook is a "due diligence" step: targets are asked to run a tool from npm. Two packages were at the centre of the latest wave:

  • @apexacc/cli, pitched as an AI advisor for Web3 founders that supposedly uses Claude and Gemini models;
  • @apexacc/audit, pitched as an MCP server with 18 tools for checking tokens, wallets and smart contracts.

Neither does what it claims. The "audit" tools print made-up results (for example, a polished "SAFE, 91/100" token report), and the CLI scores a fictional project. Earlier packages from the same operation (@apexfdn/apex, @copilot-mcp/apex, @apexfdn/copilot-mcp) were caught this summer delivering the Atomic (AMOS) macOS stealer. The npm packages and their GitHub repositories have since been taken down.

How the infection works

After install, the package reports the host OS to the operator's server and pulls a platform-specific payload:

  • Windows: an encoded PowerShell chain fetches a PyInstaller loader. The loader escalates privileges (trying a known UAC bypass if it isn't already admin), runs anti-VM checks, and hands off to a Go loader that patches AMSI and ETW and unhooks ntdll.dll to blind endpoint tools. The final in-memory stealer collects browser passwords, cookies and history (including a bypass of Chrome's app-bound encryption), plus crypto wallets, messenger, VPN, FTP and remote-access data, Wi-Fi profiles, clipboard and screenshots. Everything is exfiltrated over Telegram.
  • macOS: a shell script downloads an archive containing a dropper for the CloudSyncD backdoor. It shows a fake password prompt, reuses the stolen password to run its payload with sudo, profiles the machine, and polls a command server for more payloads. CloudSyncD had already been seen spreading through a fake Zoom installer in September.

The AI-agent angle

This is the part that makes the campaign stand out. Beyond the stealer and backdoor, the packages can redirect OpenRouter LLM traffic through an attacker-controlled API and register a rogue MCP server in the victim's agent configuration. The operator then sees every prompt, conversation, code snippet and tool output the agent sends. The rogue MCP server can also inject instructions and tool descriptions into the agent's context, which gives it a way to steer what the agent does next.

Why it matters

Developers in crypto and AI are high-value targets: they hold wallet seeds, API keys and production access, and they install tooling all the time. Pairing a believable funding pitch with a supply-chain payload gets around the usual caution. Hijacking AI agents adds a new risk on top: an attacker who controls the agent's model endpoint or MCP tools can read proprietary code and influence the changes the agent makes.

What to do

  1. Treat "run this tool for due diligence" as a red flag. Real investors don't need you to install their npm package. Run unknown tooling in a disposable VM or container, never on a workstation that holds keys or wallets.
  2. Audit your AI agent configs. Review MCP server entries and model or base-URL settings in your coding agents (Cursor, Claude, Copilot and others) and in environment variables. Remove anything you didn't add yourself.
  3. Lock down npm installs. Pin and review dependencies, use --ignore-scripts where you can, and check new or low-reputation scoped packages before installing.
  4. Hunt for indicators. Watch for traffic to apexaccs[.]org, apexfdn[.]xyz, ehegisnightmare[.]icu and ccmihr[.]com, unexpected Telegram API traffic from workstations, and unexpected macOS password prompts or a com.apple.system.loader item.
  5. If exposed, assume full compromise. Rotate browser-saved passwords, session tokens, API keys and LLM keys, and move funds out of any wallet whose seed was present on the machine.

Malicious packages like these are exactly what our AI-assisted code review looks for: it checks your dependency tree and agent/MCP configuration for suspicious packages and unexpected endpoints before they reach a developer's machine.

Sources: original research by Elastic Security Labs, with earlier findings from SafeDep, Socket and Jamf Threat Labs, as reported by The Hacker News.

SHARE