Elastic Security Labs · Published 12 Oct
Auditing the auditor: Unmasking Apex Accelerator
By Jia Yu Chan
Excerpt
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free AI credits and coding tools, along with security audits. The group also advertised an in-person event through a dedicated invitation page, adding to its efforts to appear legitimate.
The tools delivered information-stealing malware and backdoors for macOS and Windows machines…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Elastic Security Labs on elastic.co.
Mentioned in the excerpt1
More from Elastic Security Labs8
Elastic Security Labs · Web page · Published 12 Oct
Auditing the auditor: Unmasking Apex Accelerator
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free…
Elastic Security Labs · Web page · Published 14 Apr
Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT
If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs…
Elastic Security Labs · Web page · Published 2 Sep
Credential harvesting that survives takedowns: REVSTEALER
Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. This family has gained momentum in recent months, with higher distribution volume, and has emerged as a formidable threat, featuring a comprehensive credential harvester, an…
Elastic Security Labs · Web page · Published 20 Mar
Shedding light on the ABYSSWORKER driver
Cybercriminals are increasingly bringing their own drivers — either exploiting a vulnerable legitimate driver or using a custom-built driver to disable endpoint detection and response (EDR) systems and evade detection or prevention capabilities. Elastic…
On the same topics
Check Point · Web page · Published 12 Dec
November 2023’s Most Wanted Malware: New AsyncRAT Campaign Discovered while FakeUpdates Re-Entered the Top Ten after Brief Hiatus
Researchers reported on a new AsyncRAT campaign where malicious HTML files were being used to spread the stealthy malware. Meanwhile, downloader FakeUpdates jumped straight into second place after a short break from the top ten list Our latest Global Threat…
shaddy43.com · Web page · Added 29 Oct
Emotet Malware Analysis: VBS Dropper, Fileless X.dll and ECDH C2
Emotet is a sophisticated, modular form of malware that initially emerged as a banking Trojan in 2014 but has evolved over the years to become a highly prevalent and versatile threat. Known for its ability to deliver additional malware payloads and act as a…
jamf.com · Web page · Added 29 Oct
CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode
Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file. September 30 2026 by Jamf…
SOCRadar · Web page · Published 12 Oct
Inside ICMacOS: From an Infostealer to a Persistent RAT
Over the past few years, Apple’s enterprise footprint has expanded significantly, with macOS capturing an important share of the global desktop operating system market. Modern enterprise adoption has surged, particularly in the United States, where roughly…