Fake Web3 accelerator pushes malware via npm to hijack AI agents

Security researchers have identified a sophisticated supply chain attack masquerading as a Web3 venture capital accelerator. The operation, tracked as REF8801, distributed malicious npm packages designed to infect developer machines and hijack artificial intelligence workflows. This campaign targeted cryptocurrency startups by offering free AI credits and security audits through fake tools.

What happened

The threat actors posed as the Apex Accelerator, an entity claiming to offer investments and partnerships to crypto projects. They published two primary npm packages, @apexacc/cli and @apexacc/audit, under the user account "apexaccelerator." These packages were advertised as an AI advisor for founders and a security scanner for smart contracts, respectively. The associated GitHub repositories and npm packages have since been removed, but not before compromising numerous systems.

Once installed, these packages did not provide the promised functionality. Instead, they acted as loaders for platform-specific malware. On Windows systems, the software deployed a custom information stealer that exfiltrated data via Telegram. On macOS, it installed a backdoor known as CloudSyncD. Beyond traditional data theft, the malware reconfigured local AI agents to route large language model requests through attacker-controlled infrastructure, allowing the operators to intercept prompts, code snippets, and conversation history.

Key details

• The campaign used two main npm packages: @apexacc/cli and @apexacc/audit, linked to the fake Apex Foundation.
• Windows victims received a multi-stage loader that bypasses User Account Control and patches security interfaces like AMSI and ETW.
• macOS victims were targeted with CloudSyncD, which uses fake authorization prompts to gain sudo privileges and persist on the system.
• The malware redirects OpenRouter LLM traffic and registers a malicious Model Context Protocol server to influence AI agent behavior.
• Previous iterations of this campaign in July 2026 distributed packages like @apexfdn/apex and @copilot-mcp/apex.
• Elastic Security Labs noted Russian-language comments in the source code, though the attackers' origins remain unconfirmed.

Background

Supply chain attacks in the JavaScript ecosystem often rely on developers trusting popular package managers like npm. Attackers create packages with names and descriptions that mimic legitimate tools or offer high-value services, such as free AI access or security auditing. Once a developer installs these packages, the malicious code executes during installation or runtime, often downloading additional payloads from external servers.

The Model Context Protocol (MCP) is an emerging standard that allows AI agents to interact with external tools and data sources. By registering a malicious MCP server, attackers can insert themselves into the decision-making loop of an AI agent. This enables them to not only spy on the data being processed but also inject false instructions or tool definitions, potentially causing the agent to perform unintended actions or leak sensitive context.

Why it matters

For teams running their own software, this incident highlights the risk of integrating third-party development tools without rigorous verification. The promise of free AI credits or specialized security scanners can lower guardrails, leading engineers to install unvetted software. The compromise extends beyond simple data theft; by hijacking AI agent traffic, attackers gain visibility into proprietary codebases, internal discussions, and strategic planning documents shared with AI assistants.

The technical sophistication of the malware demonstrates a shift toward targeting the development workflow itself. The Windows loader actively disables security monitoring features, while the macOS component leverages social engineering to obtain elevated privileges. This means that standard endpoint protection may be blinded if the malware successfully loads, making detection difficult until data exfiltration is observed. Furthermore, the redirection of AI traffic implies that even if the local machine is cleaned, the historical data sent to attacker-controlled APIs may already be compromised.

What you can do

• Audit your npm dependencies regularly and remove any packages from unknown or unverified publishers, especially those offering free AI services.
• Monitor outbound network traffic from development machines for unusual connections to unknown domains or unexpected API endpoints.
• Restrict the permissions of AI agents and coding assistants to prevent them from accessing sensitive repositories or internal tools without explicit approval.
• Implement strict allow-listing for Model Context Protocol servers to ensure agents only connect to trusted, verified services.
• Use isolated environments or containers for testing new development tools and scripts before installing them on primary workstations.
• Educate team members about the risks of installing CLI tools from social media links or unsolicited investment offers.