A fake Web3 accelerator called Apex has been using malicious npm packages to target cryptocurrency start-ups and founders with what appeared to be free AI credits, coding tools, smart-contract audits, investment access, and invitations to in-person events.

Behind the polished Web3 pitch, the operation delivered malware for macOS and Windows, exposed AI-agent data to attacker-run systems, and provided false security results that could mislead teams into trusting unsafe code.

The campaign used two npm packages, @apexacc/cli and @apexacc/audit, presented as an AI coding agent and a Model Context Protocol (MCP) security-audit tool. Users who ran the packages through npm or npx could trigger a multistage infection chain.

The operation is especially concerning because crypto founders often handle wallet keys, source code, cloud credentials, investor data, and smart-contract material on the same developer systems.

Analysts at Elastic Security Labs identified the malicious @apexacc/cli package after a supply-chain monitor flagged suspicious behavior.

Their investigation linked it to a broader operation posing as the Apex accelerator and later found @apexacc/audit, another malicious package from the same publisher. The packages were malicious when published rather than being legitimate projects that were later compromised.

Fake Web3 Accelerator Uses Malicious npm Packages

Apex presented its main service as “Apex Arena,” a private workspace for Web3 founders. The site claimed more than 200 portfolio projects and more than $124 million raised.

It promoted smart-contract reviews, founder messaging, a directory of vetted talent, investment scoring, free Claude and Gemini credits, and the Apex Copilot coding tool.

The group also used fake reviews and advertised a physical event connected to TOKEN2049 in Singapore, a tactic designed to make the operation look like a real startup programme.

This mix of AI services, crypto branding, public repositories, and live-event activity shows how modern social-engineering campaigns can move beyond a simple phishing page.

Similar risks were seen in a malicious npm campaign targeting Web3 developers, where poisoned packages sought wallet phrases, API tokens, SSH keys, and cloud credentials.

Apex Copilot largely copied the legitimate open-source Oh My Pi coding agent. Elastic found that 1,351 of 1,363 compared source files matched the original project.

The altered code added a bootstrap component that could receive commands from Apex-controlled infrastructure, change AI service routing, and add an attacker-controlled MCP server to the victim’s configuration.

Malware Delivery on Windows and macOS

The npm package launchers used apex.cjs and audit.cjs to download platform-specific files from GitHub releases. On Windows, the code contacted vrf.apexaccs[.]org and received server-selected commands. It then created PowerShell and VBScript staging files before launching wscript.exe, PowerShell, and later malware stages.

The Windows chain led to a custom information stealer through bludness.exe, install.exe or exegis.exe, and updater_loader.exe. The final payload collected system details, clipboard data, screenshots, browser information, Wi-Fi profile names, files, and data from wallet, VPN, remote-access, messaging, and AI-client applications.

It also targeted Chrome, Edge, Firefox, and Yandex browser data, including saved credentials and cookies, before archiving collected material and sending it through Telegram.

On macOS, a Rust helper requested a command from the same verification service. The command fetched a script that delivered CloudSyncD, a backdoor which requested the user’s administrator password through a fake prompt and then collected host information before contacting its command-and-control server.

The CloudSyncD delivery method overlaps with the earlier fake Zoom installer CloudSyncD campaign, which also used a counterfeit installer and password prompt to run a privileged backdoor on macOS devices.

Apex Copilot changed OpenRouter-related environment settings so that model requests were sent to arena.apexaccs[.]org, rather than directly to the expected AI provider endpoint.

Elastic confirmed that prompts, conversation history, code snippets, local tool output, and available tool definitions could be sent to the Apex-controlled service.

The package also wrote an apex-copilot MCP entry into ~/.apex/agent/mcp.json, giving the remote server a lasting connection path across later sessions.

This is important because MCP tools may be allowed to read local files, call APIs, or run actions through AI clients. The danger follows a pattern documented in the first malicious MCP server discovery, in which a trojanized npm tool silently copied emails handled by an AI agent.

The second package, @apexacc/audit, claimed to offer 18 smart-contract security tools. Elastic found that every tool returned fabricated results rather than performing the stated checks. Some results were hard-coded, some inserted user-provided labels, and others used random or date-based values.

In one test, Apex’s remote scoring tool returned a score of 51/100 for a fictional project despite receiving no code repository, contract address, team data, or other evidence.

Teams should remove the two Apex packages from developer systems, review shell history and endpoint telemetry, and rotate secrets that may have been exposed.

This includes crypto wallet credentials, seed phrases, API keys, cloud tokens, GitHub credentials, browser sessions, SSH keys, and AI-service tokens.

Organisations should also examine AI-agent configuration files for unexpected MCP entries and review outbound connections to the listed domains.

Developers should verify npm publisher identity, repository ownership, release history, and package behavior before installing unfamiliar Web3 or AI tools.

npm lifecycle scripts can run during installation, while npm’s ignore-scripts setting prevents scripts declared in package.json from running; this can provide a safer review step, although explicitly invoked package commands can still execute.

Security teams should also alert on npm-launched PowerShell, VBScript, curl, or shell activity, especially when it creates files in temporary folders or downloads executable content.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.