Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents
Do Son 
In-person event invitation page
| At a glance | |
| Malware family | CloudSyncD (macOS) and a custom Windows information stealer |
| Threat actor | Unknown operators behind the fake “Apex” accelerator; no attribution |
| Targets | Cryptocurrency and Web3 start-ups and founders |
| Delivery vector | npm packages @apexacc/cli and @apexacc/audit, plus GitHub repositories |
| Key capabilities | Remote command execution, LLM traffic interception, credential and wallet theft, Telegram exfiltration |
| Source | Elastic Security Labs, with earlier reporting from SafeDep and Jamf |
TL;DR
Elastic Security Labs traced two malicious npm packages to a fake Web3 venture accelerator called Apex. The packages promised free AI credits, a coding assistant, and security audits for crypto founders. Instead, they installed stealers and backdoors on macOS and Windows and rerouted AI agent traffic to attacker servers.
A fake accelerator with a real-looking front
The fake Web3 accelerator spent months building a public image. Its “Apex Arena” site claims over 200 portfolio projects and more than $124 million raised. Those figures are the group’s own claims, and nothing supports them. The group also posted fake reviews and promoted an in-person event. In addition, Elastic says it built credibility through a presence at TOKEN2049 in Singapore.
Elastic warns that “AI-generated code, websites, and portfolios increasingly make illegitimate operations look polished and well-established.”
Delivery
The trail began when Elastic’s supply chain monitor flagged @apexacc/cli. The researchers found it was malicious from the first release, not a hijacked package. SafeDep had already reported the same publisher in an earlier campaign. Soon after, the actor published a second package, @apexacc/audit.
The CLI package poses as “Apex Copilot,” an AI coding assistant. In reality, it repackages the open-source agent Oh My Pi. Of 1,363 files, 1,351 match the original exactly. As a result, the tool works as promised, which hides the extra code. The audit package, meanwhile, advertises an MCP server with 18 security tools.
Infection chain
Both malicious npm packages use launchers that download platform-specific programs from GitHub releases. Each program then asks an attacker server for a “verification” command and runs whatever comes back.
macOS: CloudSyncD
On Macs, a small Rust helper fetches a shell command. That command pulls an installer for CloudSyncD, a family Jamf has described before. The malware shows a fake password prompt and checks the password against the system. Next, it runs its main payload with admin rights. Meanwhile, the victim sees a fake “shared library version mismatch” error.
Windows: a five-stage stealer
On Windows, the chain is longer. A PowerShell script fetches a Python loader that tries a known UAC bypass. A second Python stage runs anti-VM checks against 15 blocklists. Then a Go loader tries to blind security tools by restoring a clean copy of ntdll.dll and patching AMSI and ETW. Finally, it runs the stealer in memory.
The audit package goes further on Windows 11. It asks for admin rights to exclude its folder from Microsoft Defender. It also tries to switch off Smart App Control.
Notably, several stages contain bugs. For instance, one Python loader crashed in Elastic’s tests because of a missing dependency.
Command-and-control and data exfiltration
Hijacked AI agent traffic
The most unusual trick targets the AI agent itself. Apex Copilot sends model requests to an Apex server while still labeling them as OpenRouter. In tests, file contents the agent read later appeared in requests to that server. In addition, the tool registers an attacker-controlled MCP server that can feed instructions into the agent’s prompt.
Elastic says control of that endpoint could let an attacker inject tool calls. Tool approvals default to “yolo” mode. However, Elastic “didn’t observe malicious LLM response substitution.”
Telegram exfiltration
The Windows stealer collects passwords, cookies, wallets, messenger data, VPN configs, and screenshots. It also grabs config files from Claude, Cursor, and Windsurf. To read Chrome data, it defeats App-Bound Encryption by borrowing SYSTEM and user tokens. Finally, it zips the loot and sends it to a Telegram bot.
On macOS, CloudSyncD fingerprints the host and sends encrypted data to its C2 server. It can then fetch and run more payloads. However, Elastic saw no extra payloads during testing.
Audits that never ran
The “security” tools were fake too. According to Elastic, all 18 audit tools return “hard-coded, input-formatted, date-derived, or randomized reports.” One honeypot check always answers “NOT A HONEYPOT.” In a separate test, the scoring service gave a made-up project 51 out of 100.
Who is behind it
Attribution is unconfirmed. Commit history contains a few Russian-language comments. However, Elastic notes that these artifacts “alone don’t establish nationality or actor attribution.” The operators also rotated download domains several times.
Defense and detection guidance
Defenders should consider these steps:
- Remove @apexacc/cli and @apexacc/audit, then rotate any secrets on affected machines.
- Vet accelerators and investors through independent sources before installing their tools.
- Review MCP configuration files for servers you did not add.
- Check AI agents for changed API base URLs or unexpected tokens.
- Avoid “yolo” tool approval modes in coding agents.
- Alert on Defender exclusions and Smart App Control changes made by user software.
- Flag unexpected Telegram API traffic from workstations.
- Treat unexpected macOS password prompts from new tools as suspicious.
Overall, these malicious npm packages show how a fake Web3 accelerator can turn free AI perks into a trap. Founders should verify every offer before running its code.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
