Fake Web3 accelerator spreads stealers via npm and hijacks AI agent traffic

A fake Web3 venture accelerator targeted cryptocurrency startups and founders with malicious npm packages that installed information stealers and backdoors on Windows and macOS while hijacking the victims' AI agent traffic, The Hacker News reported on October 19, citing research from Elastic Security Labs. Elastic tracks the operation as REF8801. The campaign is notable for combining classic credential theft with interception of coding agent prompts, code snippets and tool outputs.

What happened

According to the report, the operators posed as "Apex Accelerator" and offered founders free AI credits for Anthropic Claude and Google Gemini, coding tools and security audits. The group promoted itself at the TOKEN2049 conference in Singapore and other in-person events, approaching developers of crypto wallets and trading intelligence tools with investment offers.

The malicious packages included @apexacc/cli, marketed as an AI advisor for Web3 founders, @apexacc/audit, presented as a Web3 security scanner and MCP server, as well as @apexfdn/apex, @copilot-mcp/apex and @apexfdn/copilot-mcp. The Hacker News said the packages and their GitHub repositories are no longer accessible. The audit tools produced fabricated findings to appear legitimate.

Technical details

On Windows, Elastic observed a multi-stage chain using PowerShell, a PyInstaller loader and attempts to bypass User Account Control. The final stage is a Go-based loader that disables AMSI and ETW protections and runs a native stealer targeting browsers, crypto wallets, messaging apps, VPN and FTP clients and saved credentials. Stolen data is exfiltrated via Telegram.

On macOS, a remote script drops a backdoor called CloudSyncD, which shows a fake authorization prompt to capture the user's login password and then runs with elevated privileges, collecting host information and contacting a command server for further payloads.

The most unusual element is the AI angle. According to Elastic, the packages redirect OpenRouter model traffic and register an attacker-controlled MCP server in the victim's agent configuration. This gives the operators access to prompts, conversation history, code snippets and tool outputs, and lets them inject instructions and define tools that can steer the agent's behavior.

Who is affected

The campaign targeted Web3 founders and developers who installed any of the listed packages. Elastic noted Russian-language comments in the source code history but said this is not enough to identify the operators. Reported infrastructure includes the domains apexaccs[.]org and apexfdn[.]xyz.

What to do

Developers should check projects and machines for the listed package names, review AI agent and MCP configurations for unfamiliar servers or altered model endpoints, and block the reported domains. Anyone who installed the packages should treat the system as compromised and rotate credentials, API keys and wallet keys from a clean device. Unsolicited investment offers or free AI credits from unknown accelerators deserve extra scrutiny.