Fake Web3 accelerator spreads stealers via npm and hijacks AI agent traffic
A fake crypto accelerator tracked as REF8801 lured founders into installing npm packages that drop stealers and a macOS backdoor while rerouting AI agent traffic to attacker-run services.