Fake Web3 'Apex Accelerator' (REF8801) uses malicious npm packages to deploy stealers, CloudSyncD backdoor and hijack AI agent traffic
Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…