Apex Accelerator: 2 Malicious npm Packages Delivered Stealers to Web3 Founders via Fake VC Scheme

A fake Web3 venture capital accelerator operating under the names "Apex Accelerator" and "Apex Foundation" distributed two malicious npm packages to cryptocurrency founders and developers, delivering information-stealing malware for macOS and Windows while routing AI model traffic through attacker-controlled servers, according to a report published by Elastic Security Labs on October 11, 2026 and covered by The Hacker News on October 19, 2026. The operation, tracked by Elastic Security Labs as REF8801, lured targets with offers of free AI credits, coding tools and security audits.

What was the specific vulnerability?

The vulnerability was not a flaw in any product but a social-engineering and supply-chain campaign: two malicious npm packages, @apexacc/cli and @apexacc/audit, were published by the npm user "apexaccelerator" and marketed as legitimate developer tools. According to The Hacker News, @apexacc/cli was advertised as "Apex Copilot CLI, AI advisor for Web3 founders," claiming to be powered by "Claude Fable 5" and "Gemini 2.5 Flash," while @apexacc/audit posed as a "Web3 Security Scanner" offering 18 tools for smart contract auditing and operated as a malicious MCP server.

Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic, in their October 11, 2026 report "Auditing the auditor: Unmasking Apex Accelerator," stated: "The tools delivered information-stealing malware and backdoors for macOS and Windows machines. The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings."

Both packages used a vetting and command infrastructure to fetch platform-specific stages: they POST to "win32" or "darwin" at vrf.apexaccs[.]org/api/v1/vrf, and Windows stages were fetched from 0auth-chromium[.]com/APIService and ehegisnightmare[.]icu. Elastic also noted Russian-language comments in the commit history of the repackaged code.

On macOS, the payload was a backdoor called CloudSyncD. On Windows, the chain ran from PowerShell through a drop.ps1 script to bludness.exe, a PyInstaller Python loader with a UAC bypass, then to exegis.exe, which performed anti-VM checks, and finally to a Golang loader that patched AMSI and ETW and unhooked ntdll.dll before deploying a native shellcode stealer. The Windows stealer exfiltrated its haul through Telegram.

How was the incident detected?

The campaign was detected by Elastic Security Labs through a Slack notification from its supply-chain monitor bot, which flagged @apexacc/cli; the package was malicious from the moment it was published, not a compromised legitimate dependency. Elastic published its findings on October 11, 2026. This was not the first wave: as The Hacker News notes, SafeDep detailed three earlier npm packages from the same operation in late July 2026, including @apexfdn/apex, @copilot-mcp/apex and @apexfdn/copilot-mcp, which distributed the Atomic Stealer (AMOS) macOS stealer. Socket artifacts link the Apex Foundation to at least two domains since April 2026: apexaccs[.]org and apexfdn[.]xyz.

What is the current impact?

The malicious npm packages and their linked GitHub repositories are no longer accessible, and the fake event listing was taken down for violating the platform's terms of service, but victims who installed the tools face lasting exposure. According to Elastic Security Labs, the Windows stealer harvested system information, clipboard contents, process lists, Wi-Fi profiles, screenshots, and data from crypto wallets, browser extensions, messengers, FTP and RDP applications, VPN clients, browsers including Chrome, Edge, Firefox and Yandex, and game clients. It could also bypass Chrome's App-Bound Encryption to extract saved passwords, session cookies, browsing history and download records.

The AI-specific angle compounds the risk: the repackaged coding agent intercepted OpenRouter LLM traffic and registered a persistent attacker-controlled MCP server, and all 18 tools in @apexacc/audit returned fabricated findings. In one test, @apexacc/cli's remote scoring service returned a score of 51/100 for a fictitious project while claiming its AI scorer was unavailable. The group built credibility with a website claiming "over 200 portfolio projects" and "more than $124 million in capital raised," fake reviews, a presence at TOKEN2049 in Singapore, and direct approaches on X to developers of crypto wallets and market intelligence tools, instructing them to run the "due diligence" tool.

What are the next steps?

There is no patch to apply, since the campaign relied on social engineering rather than a software flaw. Founders and developers who installed either package or ran the audit tools should remove the malware, including the CloudSyncD backdoor on macOS and the stealer chain on Windows, and rotate credentials for crypto wallets, browsers, messengers, VPN and FTP clients. Because session cookies and App-Bound Encryption-protected secrets were targeted, credential rotation should extend to any account accessed from an affected machine. Teams should also verify accelerator and audit offers independently before running any npm package, and treat MCP server registrations and LLM routing configurations as part of their security review.

By the numbers

Source snapshot