Fake Apex Accelerator npm packages spread stealers and backdoors
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
74
Product
@apexacc/audit
- Mentions · 7d1
- Mentions · 30d2
- All mentions2
- First seenOct 12, 2026
- Last mentioned6d ago
Timeline
2 articles · newest firstAuditing the auditor: Unmasking Apex Accelerator
Elastic unmasked Apex, a fake Web3 accelerator pushing malicious npm packages and infostealers to crypto founders.
61
Appears with
- SafeDeporganization · 2
- @apexacc/cliproduct · 2
- CloudSyncDmalware · 2
- Apex Foundationorganization · 1
- Geminiai model · 1
- cryptocurrency start-upsvictim · 1
- REF8801threat actor · 1
- Geminiproduct · 1
- Claudeproduct · 1
- npmvendor · 1
- Elastic Security Labsorganization · 1
- Apex Acceleratorthreat actor · 1
- Claude Fable 5ai model · 1
- Gemini 2.5 Flashai model · 1
- npmproduct · 1
- AMOSmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.