npm malware steals data and reroutes AI agent traffic
npm malware distributed through a fake Web3 accelerator targeted cryptocurrency startups with supposed artificial intelligence (AI) credits, coding assistance and security audits. Elastic Security Labs reports that the operation, tracked as REF8801, delivered information stealers, which collect private data, and backdoors, which provide hidden remote access, to Windows and macOS systems. It also altered a legitimate coding agent so that model requests passed through infrastructure controlled by the attackers.
The operation presented itself as Apex Accelerator, a venture capital accelerator for blockchain-focused Web3 projects. Two packages were published through npm, a widely used ecosystem for distributing software components: @apexacc/cli, described as an AI adviser for Web3 founders, and @apexacc/audit, presented as a Web3 security scanner with 18 tools for do your own research and smart contract auditing. Both targeted Windows and macOS. The packages and their associated GitHub repositories are no longer accessible.
The first package claimed to use Claude Fable 5 and Gemini 2.5 Flash. The second claimed to be a Model Context Protocol (MCP) server, meaning software that connects AI agents with external tools and data, for examining tokens, wallets and smart contracts. Both were published by the npm account apexaccelerator, linked to the GitHub account apexaccs and an entity called the Apex Foundation. Elastic found Russian-language comments in the commit history, but said that evidence was not enough to identify the operators or determine their origin.
The campaign had operated through other packages before the latest findings. SafeDep reported in late July 2026 that @apexfdn/apex, @copilot-mcp/apex and @apexfdn/copilot-mcp were associated with the same activity and distributed the Atomic Stealer, also known as AMOS, malware family on macOS. Socket artifacts connected the purported foundation with apexaccs[.]org and apexfdn[.]xyz from at least April 2026. An Internet Archive snapshot from March 19, 2026 showed a claim that the organisation offered $235,000 in investments, grants and partnerships, as well as introductions to investors.
Posts on X showed the operation approaching developers of cryptocurrency wallets and market intelligence products with investment proposals, followed by instructions to run its due diligence package. In one chain, @apexacc/cli dropped an encrypted loader disguised as an Apple application named com.apple.system.loader. Elastic also said the group attempted to establish credibility through appearances at TOKEN2049 in Singapore and other in-person events.
Neither of the newer packages delivered its advertised service after installation. The audit package produced fabricated security findings, while the command-line package returned an unsupported score for a fictitious project. Both contacted vrf.apexaccs[.]org/api/v1/vrf with a Windows or macOS platform identifier and retrieved the corresponding payload from project release files hosted on GitHub.
On Windows, the package received a Base64-encoded PowerShell command that contacted 0auth-chromium[.]com/APIService for a second script named drop.ps1. That script downloaded bludness.exe from ehegisnightmare[.]icu and started it in a hidden window. The executable was created with PyInstaller, a tool that bundles Python programs into standalone applications. If it already had administrator access, it downloaded another file as %TEMP%\exegis.exe. Otherwise, it attempted to bypass User Account Control (UAC), Windows' privilege confirmation mechanism, using UACME's ucmDebugObjectMethod().
The exegis.exe stage gathered system details and running processes, checked for signs of a virtual machine and unpacked updater_loader.exe. A Golang executable, meaning a program built in the Go language, then interfered with the Antimalware Scan Interface and Event Tracing for Windows, mechanisms used to inspect scripts and record system activity. It also restored a clean copy of ntdll.dll to evade monitoring before running shellcode, compact instructions executed directly in memory.
The final Windows information stealer checked for an earlier infection and collected system data, clipboard contents, running processes, Wi-Fi profile names and screenshots. It also targeted cryptocurrency wallets, browser extensions, messaging software, remote-access and file transfer applications, virtual private network clients, game clients and data held by Google Chrome, Microsoft Edge, Mozilla Firefox and Yandex. Elastic reports that it could bypass Chrome's app-bound encryption (ABE), a protection for locally stored browser secrets, to obtain passwords, session cookies, browsing history, download records and profile metadata. Stolen information was sent through Telegram.
On macOS, the package downloaded and ran a remote shell script. That script retrieved a GZIP-compressed archive from verify.apexfdn[.]xyz/unix/, stored it temporarily as package.tar.gz and extracted a CloudSyncD dropper. CloudSyncD displayed a false authorisation request to obtain the user's system password, then used that password to run an embedded payload with sudo administrator privileges. It surveyed the host, collected hardware and operating-system information, and contacted ccmihr[.]com to send the data and receive instructions for downloading and running further payloads.
Jamf Threat Labs first documented CloudSyncD late in the previous month after finding it distributed through a fake Zoom installer. The malware had been detected in the wild in mid-September 2026. Jamf described it as part of a move toward native macOS code, protected strings and execution paths intended to avoid placing payloads on disk, while still relying on users entering their passwords into deceptive prompts.
The packages also changed AI agent configurations. Elastic found that they could intercept and redirect OpenRouter large language model (LLM) traffic, meaning requests sent to systems that process and generate language, and register an attacker-controlled MCP server. That configuration could expose prompts, conversation history, source code and tool output included in model requests. The malicious server could also add instructions and tool descriptions to an agent's prompt, potentially influencing which tools the agent selected and how it used them.
For website owners and IT teams, the incident shows that an apparently professional investment or audit process can become a software supply-chain attack when recipients are asked to install unverified developer packages. Organisations should treat unsolicited due diligence tools as executable software, verify the publisher independently and inspect AI agent settings for unfamiliar servers or API destinations. For businesses seeking support with this work, AEU-I provides security-first IT, infrastructure and consulting.
Also available in: Deutsch