Fake Web3 'Apex Accelerator' (REF8801) uses malicious npm packages to deploy stealers, CloudSyncD backdoor and hijack AI agent traffic

Linha do tempo

1. thehackernews.com ↗ · pub. 19/10/2026 07:06 · coletado 19/10 17:53 primeiro registro

   Fake Web3 'Apex Accelerator' (REF8801) uses malicious npm packages to deploy stealers, CloudSyncD backdoor and hijack AI agent traffic

   ler a análise desta fonte ocultar

   Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Claude and Gemini credits, coding tools and audits. In practice they deliver a custom Windows information stealer that exfiltrates via Telegram and the CloudSyncD macOS backdoor. They also redirect OpenRouter LLM traffic and register an attacker-controlled MCP server in the victim's agent configuration. The operator is unknown, although Russian-language comments were found in the commit history, which is not enough for attribution. The campaign dates back at least to July 2026, when SafeDep documented related packages distributing an Atomic Stealer (AMOS) variant.

   Technical Details

   • Packages were published by npm user apexaccelerator, linked to the GitHub account apexaccs. Related packages: @copilot-mcp/apex and @apexfdn/copilot-mcp. The packages and repositories are no longer accessible.
   • The advertised functionality is fake: the 18 audit tools generate fabricated findings, and the cli scoring returns an unsupported assessment of a fictitious project. Social engineering was reinforced through X outreach and presence at TOKEN2049 Singapore.
   • Both packages send an HTTP POST with win32 or darwin to vrf.apexaccs[.]org/api/v1/vrf to select the next stage. Platform executables are fetched from GitHub releases.
   • Windows chain: Base64 PowerShell contacts 0auth-chromium[.]com/APIService to get drop.ps1, which downloads bludness.exe from ehegisnightmare[.]icu and runs it hidden. This PyInstaller loader attempts a UAC bypass via UACME ucmDebugObjectMethod() if not elevated. It then fetches %TEMP%\exegis.exe, which does system profiling and anti-VM checks and launches %TEMP%\updater_loader.exe. The Golang loader patches AMSI and ETW, unhooks ntdll.dll and loads shellcode, a native stealer.
   • The stealer collects system info, clipboard, processes, Wi-Fi profiles, screenshots, and data from wallets, browser extensions, messengers, FTP/VPN/remote-access clients, browsers (Chrome, Edge, Firefox, Yandex) and game clients. It bypasses Chrome app-bound encryption to take passwords, cookies, history and downloads, and exfiltrates via Telegram.
   • macOS chain: a dropper masquerading as an Apple app (com.apple.system.loader) retrieves a bash script, which downloads package.tar.gz from verify.apexfdn[.]xyz/unix/. The CloudSyncD dropper phishes the login password with a fake authorization prompt, runs its payload with sudo, performs host discovery and contacts ccmihr[.]com for tasking and additional payloads. CloudSyncD was first documented by Jamf Threat Labs and seen in the wild in mid-September 2026 via a fake Zoom installer.
   • AI agent hijacking: OpenRouter LLM traffic is redirected and an attacker MCP server is registered, exposing prompts, conversation history, code snippets and tool outputs. The attacker can also inject instructions into the agent prompt and influence tool invocation.

   Remediation

   • Do not install npm packages from unverified publishers, especially those tied to unsolicited investment or accelerator offers. Verify the identity of the organization first.
   • Hunt for the listed domains, filenames and artifacts, and for unexpected changes to OpenRouter endpoints or MCP server entries in agent configurations.
   • Treat any host that ran these packages as compromised: rotate credentials and session tokens, and move crypto wallet assets and keys.
   • Be wary of unexpected password prompts on macOS and monitor for AMSI/ETW tampering and UACME-style UAC bypasses on Windows.