Fake Apex Accelerator npm packages spread stealers and backdoors
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
74
Malware
Atomic Stealer
- Mentions · 7d0
- Mentions · 30d1
- All mentions4
- First seenAug 14, 2026
- Last mentioned11d ago
Timeline
4 articles · newest firstInfostealers Are Hijacking Claude Sessions and Draining Subscriptions
Infostealers hijacked active Claude sessions to bypass 2FA, drain paid usage and run unauthorized charges; Anthropic is revoking sessions and refunding.
68
Anthropic locks out Claude users after infostealers hijack login sessions
Anthropic invalidated Claude sessions compromised by infostealers such as Vidar, Lumma and Atomic Stealer, which steal browser cookies to bypass 2FA.
70
AmnesiaStealer Gives Attackers Live Control of Victims’ macOS Browsers
Jamf Threat Labs analyzed AmnesiaStealer, a Rust-based macOS infostealer spread via fake GitHub pages that also grants live hidden browser control.
48
Appears with
- Claudeproduct · 3
- RedLinemalware · 2
- StealCmalware · 2
- Anthropicvendor · 2
- Anthropicorganization · 2
- Acreedmalware · 2
- Vidarmalware · 2
- CloudSyncDmalware · 1
- Telegramproduct · 1
- npmvendor · 1
- Elastic Security Labsorganization · 1
- AmnesiaStealermalware · 1
- Gemini 2.5 Flashai model · 1
- Jamf Threat Labsvendor · 1
- AMOSmalware · 1
- GitHuborganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.