A fake Web3 accelerator, allegedly called Apex Accelerator and tracked as REF8801, has been observed distributing information-stealing malware and backdoors through malicious npm packages. The two packages, @apexacc/cli and @apexacc/audit, were marketed as an AI adviser for Web3 founders and a Web3 security scanner, respectively, and were linked to an npm user named apexaccelerator and a GitHub account named apexaccs.
Once installed, the packages did not deliver promised functionality; instead, they fed an information stealer on Windows and macOS and repackaged a legitimate coding agent to route model requests through attacker-controlled services. The audit tools generated fake security findings.
The operation also aimed to intercept and manipulate OpenRouter LLM traffic and to register an attacker-controlled MCP server within the victim’s agent configuration, enabling the attackers to influence prompts and tool selection. On Windows, the infection chain downloads multiple PowerShell and binary stages, ultimately delivering a Golang-based loader that patches AMSI/ETW, unhooks ntdll, and exfiltrates a wide range of data via Telegram.
On macOS, a remote Bash script fetches a dropper for a backdoor called CloudSyncD, after a prompt-based credential phish, with the payload executing with elevated privileges. The campaign has been noted at TOKEN2049 in Singapore and is associated with prior August–July activity under the same Apex Foundation network. Evidence includes package descriptions, GitHub links, and artefacts tied to the Apex Foundation domains apexaccs[.]org and apexfdn[.]xyz.