Skip to content
Hacker Posts

Fake 'Apex' Web3 accelerator seeds npm malware, hijacks AI agents

Elastic ties a fake Web3 accelerator (REF8801) to malicious npm packages that drop stealers and reroute AI-agent traffic through an attacker-controlled MCP server.

Published 3 min read
supply-chainnpmai-securitythreat-intel

A fake Web3 venture accelerator called Apex used malicious npm packages to drop infostealers and, more unusually, to quietly reroute a developer's AI-agent traffic through infrastructure the attacker controls. Elastic Security Labs tracks the operation as REF8801. If your developers were pitched "free AI credits," a security-audit CLI, or a coding agent from an Apex-branded entity, treat those machines as compromised.

The primary source is Elastic Security Labs' report by Jia Yu Chan and Daniel Stepanic; The Hacker News corroborated it. The packages and their GitHub repos are already offline.

The lure and the packages

Operators approached developers of crypto wallets and trading tools with investment offers and told them to run the packages, pitched as free Claude and Gemini credits, coding tools and security audits. Named packages include @apexacc/cli ("AI advisor for Web3 founders"), @apexacc/audit (a claimed 18-tool MCP security scanner), @apexfdn/apex, @copilot-mcp/apex and @apexfdn/apex. None do what they advertise — the audit tool's 18 checks all return fabricated clean findings.

What they do

  • Windows: a chain of PowerShell and PyInstaller stages — UAC bypass via UACME, AMSI/ETW patching, ntdll unhooking — ending in a native stealer that exfiltrates over Telegram.
  • macOS: a remote bash script pulls an archive and a dropper that phishes the login password through a fake authorization prompt, then launches the CloudSyncD backdoor with sudo.
  • AI-agent hijack: the tooling registers an attacker-controlled MCP server in the victim's agent configuration and reroutes OpenRouter LLM traffic. Per Elastic, that lets the attacker read prompts, conversation history, code snippets and tool outputs — and inject instructions back into the agent, defining tool names and descriptions to steer later actions.

Elastic did not attribute the campaign: it noted Russian-language commit comments but said that is not enough to establish identity or origin. Treat attribution as open.

Indicators published by Elastic:

Domains:   apexaccs[.]org, apexfdn[.]xyz, vrf.apexaccs[.]org,
           verify.apexfdn[.]xyz, 0auth-chromium[.]com,
           ehegisnightmare[.]icu, ccmihr[.]com
Paths:     vrf.apexaccs[.]org/api/v1/vrf, 0auth-chromium[.]com/APIService,
           verify.apexfdn[.]xyz/unix/
Files:     drop.ps1, bludness.exe, exegis.exe, updater_loader.exe,
           com.apple.system.loader (loader), CloudSyncD (backdoor)

Action checklist

  1. Remove the listed packages and audit package.json/lockfiles across dev machines and CI for any @apexacc, @apexfdn or @copilot-mcp/apex entries.
  2. Inspect every developer's AI-agent config for unexpected MCP servers or an altered LLM/OpenRouter endpoint, and remove them.
  3. Block the domains above and hunt for the file artifacts and the Telegram exfil behavior.
  4. Treat exposed hosts' credentials, API keys and crypto wallets as compromised and rotate/move them.

Context

npm keeps serving as a malware channel aimed at developers — see Mastra's dependency takeover and the imgdecode shellcode loader. What's new here is the target: not the build pipeline but the developer's AI assistant. Registering a rogue MCP server turns the agent into a listening post that also takes attacker instructions — the same prompt-injection-via-tooling surface we flagged with rogue agents at Wikimedia. As agent configs spread across dev machines, they're becoming their own supply chain.

Related stories