Fake 'Apex Accelerator' Web3 fund (Elastic REF8801) lures crypto founders with free Claude and Gemini credits into malicious npm packages @apexacc/cli and @apexacc/audit: CloudSyncD backdoor on macOS, Telegram infostealer on Windows, and AI coding-agent traffic quietly routed through attacker servers
Elastic Security Labs (12 October 2026) has exposed REF8801, an operation posing as a Web3 venture-capital accelerator called Apex Accelerator (also Apex Foundation and 'Apex Arena') that targets cryptocurrency start-ups and founders. It offers investment, free Anthropic Claude and Google Gemini credits, an AI 'Apex Copilot' due-diligence tool and smart-contract security audits, and built credibility with fake reviews, a TOKEN2049 Singapore presence and in-person events. The tools are two npm packages from the npm user 'apexaccelerator' (GitHub 'apexaccs'): @apexacc/cli, advertised as an AI advisor for Web3 founders, and @apexacc/audit, advertised as a Model Context Protocol (MCP) server with 18 security tools. Elastic says both were malicious from first publish, not a supply-chain compromise; the packages and repositories are no longer available. Their launchers download platform executables from the projects' GitHub releases and ask vrf.apexaccs[.]org for a command to run. On macOS that pulls a script from verify.apexfdn[.]xyz that installs CloudSyncD, the backdoor Jamf documented on 30 September, which phishes the login password with a fake prompt, runs with sudo and takes tasks from ccmihr[.]com. On Windows a PowerShell chain (0auth-chromium[.]com, then bludness.exe and exegis.exe from ehegisnightmare[.]icu, with a UAC bypass, anti-VM checks and a Go loader that patches AMSI and ETW) ends in a native infostealer that takes browser passwords and cookies (including a Chrome app-bound encryption bypass), wallets, messengers, VPN, FTP and remote-access data, screenshots and Claude Desktop, Cursor and Windsurf config files, and sends them out through Telegram. @apexacc/audit also asks for elevation to exclude its folder from Microsoft Defender and tries to switch off Smart App Control. @apexacc/cli is a near-exact copy of the open-source coding agent Oh My Pi (1,351 of 1,363 files identical) with an added bootstrap that points the agent's OpenRouter traffic at arena.apexaccs[.]org and registers an attacker-run MCP server in ~/.apex/agent/mcp.json, so the attacker receives prompts, code, conversation history and local file contents the agent reads, and can feed instructions back into the agent; Elastic did not observe malicious response substitution. All 18 'audit' tools return fabricated results. SafeDep reported earlier packages from the same operation in late July (including @copilot-mcp/apex and @apexfdn/copilot-mcp, which dropped an Atomic Stealer variant). Primary: Elastic Security Labs; package records: Socket; wire: The Hacker News (19 Oct).
- Product
- npm packages @apexacc/cli ('Apex Copilot', repackaged Oh My Pi coding agent) and @apexacc/audit ('Apex Audit' MCP server); earlier @copilot-mcp/apex and @apexfdn/copilot-mcp; payloads CloudSyncD (macOS) and a Telegram-exfiltrating Windows infostealer
- Versions
- All published versions (malicious from first publish; packages and GitHub repos apexaccs/copilot and apexaccs/audit-mcp now removed)
- Exploited in Australia?
- unknown
- Patch to
- Search developer machines, lockfiles and npx caches for @apexacc/cli, @apexacc/audit, @copilot-mcp/apex and @apexfdn/copilot-mcp, and block them in your registry proxy. Block apexaccs[.]org (including arena., vrf. and token.), apexfdn[.]xyz, ccmihr[.]com, 0auth-chromium[.]com, ehegisnightmare[.]icu, arenapex[.]cloud, cloudmain365duo[.]top, fdn4apex[.]com, router-apex[.]com and apex-arena-router[.]com. Check for an apex-copilot entry in ~/.apex/agent/mcp.json, OPENROUTER_BASE_URL pointing at arena.apexaccs[.]org, a %USERPROFILE%\.apex-audit Defender exclusion, Smart App Control turned off (VerifiedAndReputablePolicyState = 0), an %APPDATA%\.cobra marker file, or ~/.local/share/cloudsync/ and ~/.config/cloudsync/ on Macs. If any of these is present, isolate and rebuild the machine, then from a clean device rotate browser-saved passwords and sessions, AI service and OpenRouter keys, Claude, Cursor and Windsurf tokens, SSH and cloud credentials, the Mac login password, and move wallet funds to new wallets. Treat any 'investor' who asks you to install their own due-diligence or audit tool as a red flag, and only add MCP servers you have vetted.
Primary: Elastic Security Labs — Auditing the auditor: Unmasking Apex Accelerator (REF8801, 12 Oct 2026) · Vendor: Socket — npm package record for @apexacc/cli (also @apexacc/audit) · The Hacker News — Fake Web3 accelerator uses npm packages to spread malware and hijack AI agent traffic (19 Oct 2026)