Fake Web3 Accelerator Uses Malicious npm Packages to Spread Malware and Hijack AI Agent Communications

Cybersecurity researchers have uncovered a malicious campaign in which a fake Web3 accelerator allegedly distributes information-stealing malware and backdoors targeting Windows and macOS computers through compromised npm packages.

The operation, tracked as REF8801, reportedly impersonates a venture capital accelerator called Apex Accelerator, using promises of free artificial intelligence credits, coding assistance and security auditing services to attract cryptocurrency founders and developers.

According to findings by Elastic Security Labs, the campaign exploits the growing demand for AI-powered development tools and blockchain security services to persuade victims to install malicious software disguised as legitimate developer utilities.

The packages claim to offer access to Anthropic Claude and Google Gemini services, alongside tools for assessing cryptocurrency projects and auditing smart contracts. However, researchers found that the software does not deliver its advertised functionality and instead deploys malware designed to steal sensitive information.

The investigation identified two npm packages associated with the operation: @apexacc/cli, marketed as an AI assistant for Web3 founders, and @apexacc/audit, advertised as a security scanning tool offering 18 utilities for examining cryptocurrency tokens, wallets and smart contracts.

Both packages and their associated GitHub repositories were reportedly no longer accessible when researchers documented the findings.

Fake Accelerator Exploits Trust in AI and Blockchain Services

The campaign allegedly operates under the identity of Apex Accelerator, presenting itself as an organisation offering investment opportunities, technical assistance and security services to cryptocurrency startups.

The operators reportedly used the names Apex Accelerator and Apex Foundation to establish credibility among potential victims.

According to the researchers, the command-line tool was advertised as an AI adviser for Web3 founders, supposedly powered by Claude Fable 5 and Gemini 2.5 Flash. The security package, meanwhile, claimed to operate as a Model Context Protocol (MCP) server equipped with tools for cryptocurrency investigations and smart contract auditing.

Both packages were published through an npm account named apexaccelerator and linked to a GitHub account called apexaccs.

Researchers also connected the operation to domains including apexaccs.org and apexfdn.xyz, with evidence suggesting that the associated infrastructure had been active since at least April 2026.

Historical website records reportedly showed the Apex Foundation advertising investment opportunities, grants and partnerships worth up to $235,000, alongside promises to connect projects with venture capital firms, angel investors and private equity organisations.

Posts on X also indicated that the operators approached developers working on cryptocurrency wallets and market intelligence platforms, encouraging them to run the purported due diligence tools as part of an investment or partnership process.

In one documented case, the malicious software reportedly deployed an encrypted malware loader disguised as an Apple application component.

Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said the operation distributed information-stealing malware and backdoors for both Windows and macOS systems. They also identified attempts to redirect AI coding requests through attacker-controlled infrastructure.

Previous Malicious Packages Linked to the Same Operation

The investigation suggests that the campaign predates the discovery of the two latest packages.

In July 2026, security researchers at SafeDep documented three other npm packages linked to the same operation. Those packages were reportedly associated with the distribution of Atomic Stealer, also known as AMOS, a malware family targeting macOS systems.

The earlier packages included @apexfdn/apex, @copilot-mcp/apex and @apexfdn/copilot-mcp.

Researchers said the descriptions of some earlier packages closely resembled those used in the newer campaign, suggesting continuity in the operators’ methods and branding.

The group also reportedly attempted to strengthen its credibility through appearances at major cryptocurrency industry events, including TOKEN2049 in Singapore, as well as other in-person gatherings.

According to Elastic Security Labs, such appearances can help fraudulent organisations create an impression of legitimacy by associating themselves with recognised industry conferences and professional networks.

Windows Malware Designed to Steal Sensitive Information

On Windows computers, the malicious packages reportedly initiate a multistage infection process that downloads additional components and eventually deploys an information stealer.

The malware collects information about the affected computer and uses several techniques intended to make detection more difficult.

Researchers found that the infection chain could gather system details, inspect running processes and check whether the malware was operating inside a virtualised environment.

Additional components reportedly attempt to interfere with security monitoring mechanisms, including the Antimalware Scan Interface and Event Tracing for Windows.

These mechanisms help security products and monitoring tools identify suspicious activity. Interfering with them can reduce visibility into malicious processes and make detection more challenging.

The final information-stealing component reportedly targets a wide range of sensitive data, including clipboard contents, screenshots, Wi-Fi profile information, browser records and information associated with cryptocurrency wallets.

The malware also targets data linked to browser extensions, messaging applications, remote-access software, FTP clients, VPN services and gaming platforms.

Supported browsers reportedly include Google Chrome, Microsoft Edge, Mozilla Firefox and Yandex.

Researchers further found that the malware attempts to bypass Chrome’s app-bound encryption protections, which are designed to make it harder for unauthorised software to extract sensitive browser data.

If successful, the malware could obtain saved passwords, session cookies, browsing histories, download records and other profile information.

The stolen information is reportedly transmitted through Telegram, providing the attackers with a channel for receiving data collected from infected computers.

intercepted AI requests and attacker-controlled tool instructions could give the operators visibility into submitted information while potentially influencing subsequent agent actions.

For organisations using AI-assisted software development, the discovery highlights the importance of monitoring third-party integrations and carefully reviewing the permissions granted to development tools.

Security Implications for Developers and Cryptocurrency Startups

The campaign demonstrates how attackers can combine social engineering, malicious software packages and AI-related features to target developers and cryptocurrency businesses.

By offering seemingly valuable services, including free AI credits, investment opportunities and security audits, fraudulent operators can encourage victims to trust software that would otherwise appear suspicious.

The consequences may extend beyond the initial infection. Stolen credentials, browser sessions, cryptocurrency wallet information and confidential source code could expose individuals and organisations to further compromise.

Developers should verify the identity of organisations offering investment or technical services, inspect npm package ownership and maintenance histories, and avoid installing software solely because it has been recommended by a purported investor or accelerator.

Organisations should also review AI agent configurations, third-party MCP servers and API routing settings for unexpected changes.

Anyone who suspects that a malicious package has been installed should treat the affected computer and any credentials entered on it as potentially compromised, investigate the incident using trusted security tools and rotate exposed credentials from a clean device.

The findings also reinforce the need for stronger software supply-chain security as AI-powered development tools become increasingly integrated into everyday programming workflows.

The key warning is that a tool advertised as an AI assistant, blockchain auditor or investment due diligence application may conceal a much broader attack. Developers and cryptocurrency founders should verify software sources carefully before granting unfamiliar packages access to their computers, credentials, source code or AI agent configurations.