Fake Web3 Accelerator Targets Crypto Founders With Malicious npm Packages

Key Takeaways

• A sophisticated campaign named “Apex” impersonated a Web3 accelerator to target cryptocurrency startups and founders.
• The attackers distributed malicious npm packages for both macOS and Windows, masquerading as AI coding agents and security audit tools.
• These packages deployed info-stealing malware on Windows and a backdoor, CloudSyncD, on macOS, designed to exfiltrate sensitive data including crypto wallet keys and cloud credentials.
• The fake accelerator provided deceptive security audit results and rerouted AI agent data to attacker-controlled servers, compromising user privacy and potentially misleading development teams.
• The campaign highlights the evolving threat of supply-chain attacks and sophisticated social engineering tactics in the Web3 space.

A deceptive Web3 accelerator, operating under the name Apex, has been observed leveraging malicious npm packages to target cryptocurrency startups and their founders. The elaborate scheme lured victims with promises of complimentary AI credits, advanced coding utilities, smart-contract audit services, exclusive investment opportunities, and invitations to purported in-person industry events.

Behind this meticulously crafted facade, the Apex operation served a dual purpose: to deliver sophisticated malware to both macOS and Windows systems, and to redirect sensitive AI-agent data to infrastructure controlled by the attackers. Additionally, the fake security tools provided misleading audit outcomes, potentially leading development teams to mistakenly trust compromised or insecure code.

The campaign utilized two primary npm packages, @apexacc/cli and @apexacc/audit, presenting them as an AI coding assistant and a Model Context Protocol (MCP) security-audit utility, respectively. Users who executed these packages via npm or npx were inadvertently initiating a multi-stage infection process.

This particular threat raises significant concerns within the cryptocurrency sector, given that founders and developers frequently manage critical assets such as wallet keys, proprietary source code, cloud credentials, investor information, and smart-contract data on their development machines.

Unmasking the Apex Threat

Analysts at Elastic Security Labs identified the malicious @apexacc/cli package after their supply-chain monitoring systems detected anomalous behavior. Their subsequent investigation uncovered a broader malicious campaign operating under the guise of the Apex accelerator, leading to the discovery of @apexacc/audit, another harmful package originating from the same publisher. Crucially, these packages were inherently malicious from their initial publication, rather than being legitimate projects later compromised.

Fake Web3 Accelerator Uses Malicious npm Packages

Apex promoted its core offering as “Apex Arena,” a private collaborative environment designed for Web3 founders. The platform falsely boasted over 200 portfolio projects and more than $124 million in capital raised. It advertised a suite of services, including smart-contract reviews, direct founder messaging, a vetted talent directory, investment scoring, free Claude and Gemini credits, and the “Apex Copilot” coding tool.

The group further bolstered its credibility through fabricated testimonials and by promoting a physical event supposedly linked to TOKEN2049 in Singapore. Such tactics are indicative of a sophisticated social engineering strategy aimed at mimicking legitimate startup acceleration programs.

The intricate blend of AI-driven services, cryptocurrency branding, public code repositories, and advertised live events demonstrates the advanced nature of modern social engineering campaigns, extending far beyond simple phishing attempts. This mirrors previous malicious npm campaigns targeting Web3 developers, which also sought to exfiltrate sensitive data such as wallet seed phrases, API tokens, SSH keys, and cloud credentials.

The Apex Copilot tool was largely a replica of the legitimate open-source Oh My Pi coding agent. Elastic’s analysis revealed that 1,351 out of 1,363 compared source files were identical to the original project. However, the modified code included a bootstrap component capable of receiving commands from Apex-controlled infrastructure. This component could alter AI service routing and inject an attacker-controlled MCP server into the victim’s configuration.

Malware Delivery on Windows and macOS

The npm package launchers, specifically apex.cjs and audit.cjs, were designed to fetch platform-specific files from GitHub releases. On Windows systems, the code established contact with vrf.apexaccs[.]org to receive server-dictated commands. It then generated PowerShell and VBScript staging files before initiating wscript.exe, PowerShell, and subsequent malware stages.

The Windows infection chain culminated in the deployment of a custom information stealer, delivered through executables such as bludness.exe, install.exe or exegis.exe, and updater_loader.exe. This final payload was engineered to harvest extensive system details, clipboard contents, screenshots, browser information, Wi-Fi profile names, various files, and data from cryptocurrency wallet applications, VPN clients, remote-access tools, messaging platforms, and AI client applications.

The stealer also targeted data from popular browsers like Chrome, Edge, Firefox, and Yandex, including saved credentials and cookies. All collected material was then archived and exfiltrated via Telegram.

For macOS users, a Rust helper application requested commands from the same verification service. This command then retrieved a script that installed CloudSyncD, a backdoor designed to prompt the user for their administrator password through a fake dialog. Once installed, CloudSyncD collected host information and communicated with its command-and-control server. This method of CloudSyncD delivery exhibits similarities to a previous campaign involving a fraudulent Zoom installer, which also utilized a deceptive installer and password prompt to establish a privileged backdoor on macOS devices.

Apex Copilot manipulated OpenRouter-related environment settings, redirecting all model requests to arena.apexaccs[.]org instead of the legitimate AI provider endpoint. Elastic confirmed that this allowed prompts, conversation histories, code snippets, local tool outputs, and available tool definitions to be transmitted to the Apex-controlled service.

Furthermore, the package created an apex-copilot MCP entry within ~/.apex/agent/mcp.json, establishing a persistent connection path to the remote server across subsequent user sessions. This is particularly concerning as MCP tools can be granted permissions to access local files, invoke APIs, or execute actions through AI clients. This vulnerability mirrors a pattern identified in the first malicious MCP server discovery, where a trojanized npm tool covertly copied emails processed by an AI agent.

The second malicious package, @apexacc/audit, purported to offer 18 distinct smart-contract security tools. However, Elastic’s investigation revealed that every single tool returned fabricated results instead of conducting genuine security checks. Some results were hard-coded, others incorporated user-provided labels, and some utilized random or date-based values. In one instance, Apex’s remote scoring tool assigned a score of 51/100 to a fictional project, despite receiving no actual code repository, contract address, team data, or other verifiable information.

What You Should Do

• Immediately remove the @apexacc/cli and @apexacc/audit packages from all developer systems.
• Review shell history and endpoint telemetry for any suspicious activity related to these packages.
• Rotate all potentially exposed secrets, including cryptocurrency wallet credentials, seed phrases, API keys, cloud tokens, GitHub credentials, browser sessions, SSH keys, and AI-service tokens.
• Examine AI-agent configuration files for any unauthorized or unexpected MCP entries.
• Monitor and review all outbound network connections to the domains listed in the Indicators of Compromise section.
• Exercise extreme caution when installing new Web3 or AI tools from npm. Always verify the publisher’s identity, repository ownership, release history, and package behavior before installation.
• Consider using npm’s ignore-scripts setting to prevent lifecycle scripts from running automatically during installation, allowing for a safer review process.
• Implement alerts for npm-launched PowerShell, VBScript, curl, or general shell activity, particularly if it involves creating files in temporary directories or downloading executable content.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.