A fake Web3 accelerator has been linked to a malware campaign that used malicious npm packages to target cryptocurrency startups and founders, while also intercepting artificial intelligence agent traffic and redirecting model requests through attacker-controlled infrastructure.
Researchers at Elastic Security Labs said the operation, tracked as REF8801, posed as a venture capital accelerator called Apex Accelerator. It promoted tools offering free AI credits for Anthropic Claude and Google Gemini, coding assistance and security audits, but the packages instead delivered information-stealing malware and backdoors to Windows and macOS systems.
The campaign also repackaged a legitimate coding agent so that model requests were routed through services controlled by the attackers. Researchers said this could expose prompts, conversation histories, code snippets and tool outputs submitted through affected AI agents.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Malicious npm Packages Targeted Web3 Founders
The campaign used two npm packages, @apexacc/cli and @apexacc/audit, both targeting Windows and macOS systems.
The first was presented as an “AI advisor for Web3 founders” powered by Claude Fable 5 and Gemini 2.5 Flash. The second claimed to operate as a Model Context Protocol server providing 18 security tools for analysing tokens, wallets and smart contracts.
Both packages and their associated GitHub repositories are no longer accessible. They had been published by an npm user named “apexaccelerator” and were linked to the GitHub account “apexaccs” and an entity calling itself the Apex Foundation.
Researchers said the campaign had been active before the latest packages emerged. In July 2026, three other npm packages associated with the same operation were found distributing a macOS information stealer from the Atomic Stealer, or AMOS, family.
The Apex Foundation had also been associated with the domains apexaccs.org and apexfdn.xyz. Archived versions of its website claimed that the organisation offered investments, grants and partnerships worth $235,000 and could connect projects with venture capital, angel investors and private equity firms.
Posts on X showed the operation approaching developers of cryptocurrency wallets and market intelligence tools with offers of investment and instructions to run its due diligence software.
Elastic said the group also sought to build credibility by appearing at TOKEN2049 in Singapore and at other in-person events.
Packages Delivered Windows Stealer and macOS Backdoor
Researchers said the promised security and advisory functions were largely fabricated.
The 18 tools offered through @apexacc/audit generated false security findings, while @apexacc/cli returned an unsupported scoring assessment of a fictitious project.
Instead, the packages were designed to deliver a macOS backdoor known as CloudSyncD and a custom Windows information stealer that sent stolen data through Telegram.
On Windows systems, the infection chain used PowerShell scripts and multiple executable stages. Researchers said the malware could attempt to bypass User Account Control, conduct anti-virtual-machine checks and interfere with security monitoring by patching Windows security interfaces and unhooking system libraries.
The final information stealer was capable of collecting system information, clipboard contents, running processes, Wi-Fi profile names and screenshots. It also targeted cryptocurrency wallets, browser extensions, messaging applications, remote-access tools, FTP clients, VPN software, browsers and gaming clients.
Researchers said the malware could bypass Chrome’s app-bound encryption protections to extract saved passwords, session cookies, browsing history, download records and profile information before exfiltrating the collected data through Telegram.
On macOS, the packages downloaded a remote shell script that retrieved an archive containing the CloudSyncD dropper.
CloudSyncD displayed a fake authorisation prompt to obtain the user’s system password and then used it to execute an embedded payload with elevated privileges. The malware collected hardware and operating-system information before contacting an external server for additional instructions and payloads.
CloudSyncD had previously been documented by Jamf Threat Labs after being distributed through a fake Zoom installer and was detected in the wild in September 2026.
Attackers Could Read and Influence AI Agent Traffic
Beyond deploying conventional malware, the malicious packages were also capable of intercepting and redirecting traffic sent to OpenRouter large language models.
Elastic researchers said the packages could modify an affected AI agent’s configuration and register an attacker-controlled MCP server.
Those changes could allow the attacker-controlled infrastructure to receive prompts, conversation histories, source code and tool outputs included in requests sent by the AI agent.
The malicious MCP server could also provide instructions that would be added to the agent’s prompt, along with tool names, descriptions and accepted inputs.
Researchers said this combination could give the attackers both visibility into information submitted through the compromised AI agent and an opportunity to influence what the agent did next.
The campaign therefore combined software supply-chain abuse, credential and data theft, malware delivery and AI-agent manipulation while presenting itself as a legitimate accelerator offering investment opportunities and technical services to Web3 founders.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
