Fake Apex Accelerator npm packages spread stealers and backdoors
Original title: Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
Elastic Security Labs says a fake Web3 accelerator, Apex Accelerator, tracked as REF8801, published npm packages that offered free Claude and Gemini credits, coding tools and security audits to crypto founders. The packages and GitHub repos are no longer accessible. They did not provide the advertised tools: audit results were fabricated, while installers fetched a Windows information stealer and a macOS backdoor called CloudSyncD. Earlier related packages were previously tied by SafeDep to Atomic Stealer on macOS.
Unconfirmed: Elastic attributes the campaign to cluster REF8801; the macOS CloudSyncD description in the source is cut off.
- Named packages are @apexacc/cli and @apexacc/audit, published by npm user apexaccelerator.
- Windows chain uses PowerShell, UAC bypass, AMSI and ETW patching, then Telegram exfiltration.
- The stealer targets browsers, wallets, messengers, VPN and FTP apps and can bypass Chrome app-bound encryption.
- Socket artifacts link Apex Foundation to apexaccs.org and apexfdn.xyz since April 2026.
- Elastic says the group appeared at TOKEN2049 in Singapore to build credibility.
Impact: Steals credentials, wallets, browser data and installs a macOS backdoor
| Product | Affected |
|---|---|
| npm @apexacc/cli | — |
| npm @apexacc/audit | — |
- 1.Remove @apexacc/cli and @apexacc/audit if installed and review related npm and GitHub activity.
- 2.Check Windows and macOS hosts for CloudSyncD and the described loader and stealer binaries.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1059.001 PowerShellT1548.002 Bypass User Account ControlT1567 Exfiltration Over Web Service
- Vendors
- npm
- Threat actors
- REF8801
- Malware
- CloudSyncDAtomic StealerAMOS
- Organizations
- Elastic Security LabsSafeDepApex Foundation
- Countries
- Singapore
- AI models
- Claude Fable 5Gemini 2.5 Flash
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 0auth-chromium.com | PowerShell command, which reaches out to another endpoint ("0auth-chromium[.]com/APIService") to fetch a second PowerShell script ("drop.p |
| domain | apexaccs.org | en linked to at least two distinct domains since April 2026 apexaccs[.]org apexfdn[.]xyz According to Internet Archive snapshots dat |
| domain | apexfdn.xyz | least two distinct domains since April 2026 apexaccs[.]org apexfdn[.]xyz According to Internet Archive snapshots dating back to Ma |
| domain | ccmihr.com | ting-system details, and then contacts an external server ("ccmihr[.]com") to transmit the data and receive further tasks that all |
| domain | ehegisnightmare.icu | p.ps1") that downloads an executable ("bludness.exe") from "ehegisnightmare[.]icu" and launches it in a hidden window. The PyInstaller exec |
From the original article
5 min read at thehackernews.com
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.