"The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said, summarizing a campaign that has wrapped malware inside seemingly legitimate npm packages and pitched free AI credits to lure victims.
Apex Accelerator, the Apex Foundation, and REF8801
The operation presents itself as a Web3 venture capital accelerator called Apex Accelerator and links to an entity dubbed the Apex Foundation. Elastic is tracking the activity under the moniker REF8801. Internet Archive snapshots going back to March 19, 2026 show the foundation promising "$235,000 investments, grants, and partnerships" and listing outreach efforts that included posts on X and attendance at TOKEN2049 in Singapore. Artifacts captured by Socket tie the group to at least two domains: apexaccs[.]org and apexfdn[.]xyz.
Malicious npm packages and the bait they used
Attackers published at least two npm packages — @apexacc/cli (Apex Copilot CLI) and @apexacc/audit (Web3 Security Scanner) — under an npm user named "apexaccelerator" and a GitHub account "apexaccs." Those packages, now removed along with their GitHub repositories, were advertised as providing AI credits for Claude and Gemini, coding tools, and 18 security scanners for tokens, wallets, and smart contracts.
- Earlier activity tied to the same operation was reported by SafeDep in late July 2026 and included packages that distributed a macOS stealer from the Atomic Stealer (AMOS) family: @apexfdn/apex, @copilot-mcp/apex, and @apexfdn/copilot-mcp.
- Socket artifacts and npm package behavior show the packages did not deliver promised functions; @apexacc/audit's 18 tools produced fabricated findings, and @apexacc/cli returned an unsupported assessment of a fictitious project.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWindows infection chain: staged loaders, AMSI and ETW tampering, Telegram exfiltration
Elastic lays out a multi-stage Windows chain that begins when the package retrieves a Base64-encoded PowerShell command and reaches out to 0auth-chromium[.]com/APIService for a second script (drop.ps1). That script downloads an executable from ehegisnightmare[.]icu ("bludness.exe") and runs it hidden.
The chain uses PyInstaller-based loaders that check for admin rights and attempt a UAC bypass via UACME's ucmDebugObjectMethod(). A subsequent PyInstaller binary collects system metadata and runs anti-VM checks before dropping a loader. A Golang executable then patches the Antimalware Scan Interface (AMSI), tampers with Event Tracing for Windows (ETW), unhooks ntdll.dll, and loads shellcode into memory. The native shellcode acts as an information stealer, harvesting clipboard contents, screenshots, Wi‑Fi profiles, process listings, and data from browsers and applications — including saved passwords, session cookies, and profile metadata — then exfiltrating collected data via Telegram.
macOS infection chain and CloudSyncD's role
On macOS the packages download and execute a remotely hosted bash script that pulls a GZIP archive from verify.apexfdn[.]xyz/unix/, extracting a dropper for a backdoor named CloudSyncD. The dropper first phishes the system login password with a fake authorization prompt and then uses that password to launch an embedded payload with sudo privileges. The payload performs host discovery, collects hardware and OS details, and contacts ccmihr[.]com to transmit data and receive further tasks.
Jamf Threat Labs had "first documented" CloudSyncD "late last month," noting prior propagation via a fake Zoom installer; the malware was detected in the wild in mid-September 2026. Jamf observed that CloudSyncD's behavior shows macOS malware moving toward native implementations and execution paths that avoid writing payloads to disk, while still relying on asking users for their passwords.
Hijacking AI agents and registering attacker-controlled MCP servers
Beyond malware delivery, the packages repackaged a legitimate coding agent to route model requests through attacker-controlled services and registered a Model Context Protocol (MCP) server under attacker control in victims' agent configurations. Elastic explained these changes allow the attacker-controlled API to receive prompts, conversation history, code snippets, and tool outputs from the agent's LLM requests, and to supply instructions — including tool names, descriptions, and inputs — that are added to the agent's prompt. In short, the attacker can both observe submitted data and influence the agent's subsequent actions. The packages also intercept and redirect OpenRouter LLM traffic.
What this means for developers, security teams, and end users
- Developers and open-source maintainers: be wary of packages resembling "@apexacc/cli" or "@apexacc/audit" and those that register external MCP servers or alter agent configs; the operation used repackaging of a legitimate agent to route model requests through attacker services.
- Security teams and incident responders: monitor unusual outbound requests to domains in the chain (for example, vrf.apexaccs[.]org/api/v1/vrf, 0auth-chromium[.]com, ehegisnightmare[.]icu, verify.apexfdn[.]xyz, and ccmihr[.]com), look for AMSI/ETW tampering or ntdll.dll unhooking, and watch for data exfiltration channels such as Telegram.
- End users and founders in the cryptocurrency space: offers of direct investment or invitations to run due-diligence tools should be validated independently; Elastic noted the operation approached wallet and market-intelligence developers and attempted to build credibility through in-person events and online presence.
The campaign demonstrates a layered approach: social engineering and community-facing marketing, repackaged developer tools that alter agent behavior, and platform-specific malware that both steals data and establishes persistent access. For now the npm packages and associated GitHub repositories have been removed, but the detailed endpoints, artifacts, and techniques Elastic, SafeDep, Socket, and Jamf recorded provide a roadmap security teams can use to detect similar operations.
