Excerpt
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free AI credits and coding tools, along with security audits. The group also advertised an in-person event through a dedicated invitation page, adding to its efforts to appear legitimate.
The tools delivered information-stealing malware and backdoors for macOS and Windows machines. The operation also repackaged a legiti…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt
More from Elastic Security Labs7
- Phantom in the vault: Obsidian abused to deliver PhantomPulse RATElastic Security Labs · Published 14 Apr
- Credential harvesting that survives takedowns: REVSTEALERElastic Security Labs · Published 2 Sep
- Shedding light on the ABYSSWORKER driverElastic Security Labs · Published 20 Mar 2025
- TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chainsElastic Security Labs · Published 16 Jul
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
