A fake Web3 venture capital accelerator called Apex Accelerator is pushing malicious npm packages to target cryptocurrency startups and founders, according to Elastic Security Labs. The packages, tracked as REF8801, promised AI credits for Claude and Gemini, coding tools, and security audits. Instead, they deployed information-stealing malware and backdoors, while repackaging a legitimate coding agent to route model requests through attacker-controlled services.
The two newly documented packages, @apexacc/cli and @apexacc/audit, are no longer available, but both targeted Windows and macOS. The audit package was an MCP server that claimed 18 security tools, yet generated fabricated findings. The same operation was previously identified in July 2026 by SafeDep, which found three other npm packages distributing a macOS stealer from the Atomic Stealer family.
On Windows, the infection ran through multiple stages: a PowerShell script downloaded a Python loader that attempted to bypass UAC, then launched a Golang payload that patched AMSI and ETW, unhooked ntdll, and loaded shellcode. That shellcode harvested credentials, wallet data, browser histories, clipboard contents, and more, exfiltrating it through Telegram. On macOS, the malware used a remotely fetched bash script and was tied to a backdoor called CloudSyncD.
The operators sought legitimacy by claiming $235,000 investments, contacting developers on X, and appearing at TOKEN2049. Researchers noted that the scheme was built to look credible, but the promised tools were never functional. The sole source here is Elastic Security Labs' report as covered by The Hacker News; no independent reporting is included for comparison.}from the single source, the key takeaway is that supply-chain campaigns can combine fake investment offers with fabricated AI features to bait developers into running malicious packages.}