// AI threat desk · 21 Oct 2026
Home/AGENT · Agent Security
Agent SecurityMediumNPMCVSS not assigned

Malicious npm packages posing as Apex Accelerator targeted crypto founders

Elastic Security Labs said malicious npm packages targeted cryptocurrency startups and founders with AI credits, coding tools and security audits.

· 3 min read
AI-generated image of security analysts investigating suspicious software packages on blurred computer screens.
AI-generated image, not a photo of the event.
Key takeaways
  • Malicious npm packages posing as a Web3 accelerator targeted cryptocurrency startups and founders.
  • The tools delivered malware and backdoors to macOS and Windows machines.

Elastic Security Labs reported on Oct 12, 2026, that it identified malicious npm packages posing as a Web3 accelerator and targeting cryptocurrency startups and founders.

The operation offered free AI credits, coding tools and security audits. Its tools delivered malware and backdoors to macOS and Windows machines, while attacker-controlled services could receive prompts, conversation history, code snippets and tool outputs from agent requests.

The packages also repackaged a coding agent to route model requests through attacker-controlled services and made audit tools return fabricated findings. Elastic Security Labs said the package was malicious from publication, rather than the result of a supply-chain compromise.

On this page

The packages redirected AI requests and controlled agent inputs

The @apexacc/cli bootstrap redirected OpenRouter-labeled model requests to an attacker-controlled API endpoint and registered an attacker-controlled MCP server in the victim’s agent configuration.

That MCP server could add instructions to an agent’s prompt and provide tool names, descriptions and accepted inputs. Those details could influence how the model selected and used tools in later actions.

The @apexacc/audit package advertised an MCP server with 18 security tools. Elastic Security Labs found that all 18 returned fabricated findings, while the @apexacc/cli scoring service returned 51/100 for a fictitious project and said its AI scorer was unavailable.

CloudSyncD and a Windows stealer formed the malware payload

Elastic Security Labs said the packages distributed CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrated data through Telegram.

On Windows, the audit package requested User Account Control elevation to exclude its application directory from Microsoft Defender Antivirus scanning and attempted to disable Smart App Control by setting VerifiedAndReputablePolicyState to zero.

Jamf Threat Labs said it first encountered CloudSyncD on Sep 15, 2026, in a build still under development. After two days of monitoring, it found samples using live infrastructure across more than one command-and-control domain.

A copied coding agent helped conceal the added components

Elastic Security Labs found that 1,351 of 1,363 files in Apex Copilot matched files in the original Oh My Pi project. The copied agent retained genuine functionality that helped conceal the added malicious components.

Jamf said CloudSyncD used a fake authorization prompt to request a victim’s login password and carried its second stage inside the first stage. It said the prompted password was never recorded or sent anywhere.

Elastic Security Labs said the operation had built a public presence over months. The Apex website claimed more than 200 portfolio projects and more than $124 million in capital, according to the lab.

What to do now

  1. In Jamf for Mac, configure threat prevention, advanced threat controls and web protection to Block and Report to help prevent similar threats.

FAQ

What happened in the operation?

Elastic Security Labs said malicious npm packages posed as a Web3 accelerator and targeted cryptocurrency startups and founders with free AI credits, coding tools and security audits.

Which npm packages were involved?

The packages included @apexacc/cli and @apexacc/audit. The Hacker News said both targeted Windows and macOS systems.

What could the packages do?

They could redirect model requests to an attacker-controlled API, send prompts and other agent data to that service, register an attacker-controlled MCP server and deliver malware or backdoors.

Was the package a supply-chain compromise?

Elastic Security Labs said @apexacc/cli was malicious from the moment it was published, rather than being a supply-chain compromise.

What is an MCP server in this incident?

The @apexacc/audit package advertised an MCP server with 18 security tools. The attacker-controlled server could supply instructions, tool names, descriptions and accepted inputs that influenced agent actions.

Sources

  1. Apex Accelerator: Malicious npm packages target Web3 startups, Elastic Security LabsPrimary
  2. Extracting Syscalls from a Suspended Process, CymulatePrimary
  3. CloudSyncD: macOS backdoor hidden in a fake Zoom installer, Jamf Threat LabsPrimary
  4. Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic, The Hacker News
How we checked this story
ClaimSourceStatus
Elastic Security Labs identified the malicious npm package @apexacc/cli as part of an operation posing as a Web3 accelerator.Elastic Security LabsConfirmed
The operation targeted cryptocurrency startups and founders with free AI credits, coding tools, and security audits.Elastic Security LabsConfirmed
The tools delivered information-stealing malware and backdoors to macOS and Windows machines.Elastic Security LabsConfirmed
The operation repackaged a legitimate coding agent to send model requests through attacker-controlled services and made its audit tools generate fabricated findings.Elastic Security LabsConfirmed
The @apexacc/audit package advertised an MCP server offering 18 security tools.Elastic Security LabsConfirmed
All 18 tools in @apexacc/audit returned fabricated findings.Elastic Security LabsConfirmed
The @apexacc/cli scoring service returned 51/100 for a fictitious project while reporting that its AI scorer was unavailable.Elastic Security LabsConfirmed
Elastic Security Labs said the @apexacc/cli package was malicious from publication rather than being a supply-chain compromise.Elastic Security LabsConfirmed
The packages redirected OpenRouter-labeled model requests to an attacker-controlled API endpoint.Elastic Security LabsConfirmed
The attacker-controlled API could receive prompts, conversation history, code snippets, and tool outputs from agent requests.Elastic Security LabsConfirmed
The attacker-controlled MCP server could supply instructions, tool names, descriptions, and accepted inputs to influence subsequent agent actions.Elastic Security LabsConfirmed
On Windows, the audit package attempted to exclude its application directory from Microsoft Defender scanning and disable Smart App Control.Elastic Security LabsConfirmed
The packages distributed CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrated data through Telegram.Elastic Security LabsConfirmed
Elastic Security Labs found that Apex Copilot matched 1,351 of 1,363 files in the original Oh My Pi project.Elastic Security LabsConfirmed
Elastic Security Labs found that the copied coding agent provided genuine functionality that helped conceal the added malicious components.Elastic Security LabsConfirmed
Elastic Security Labs said the Apex website claimed to have more than 200 portfolio projects and to have raised more than $124 million in capital.Elastic Security LabsAttributed
Jamf Threat Labs first encountered CloudSyncD on September 15, 2026, in a build still under development.Jamf Threat LabsConfirmed
After two days of monitoring, Jamf identified CloudSyncD samples using live infrastructure across more than one command-and-control domain.Jamf Threat LabsConfirmed
Jamf said CloudSyncD uses a fake authorization prompt to phish the victim's login password and carries its second stage inside the first stage.Jamf Threat LabsConfirmed
The Hacker News said the fake accelerator was named Apex Accelerator and was tracked as REF8801.The Hacker NewsAttributed
The Hacker News said the packages @apexacc/cli and @apexacc/audit targeted both Windows and macOS systems.The Hacker NewsAttributed
The Hacker News said the @apexacc/cli package was advertised as an AI advisor powered by Claude Fable 5 and Gemini 2.5 Flash.The Hacker NewsAttributed
The Hacker News said the Apex Foundation claimed to offer $235,000 investments, grants, and partnerships.The Hacker NewsAttributed
The Hacker News said the @apexacc/cli package dropped an encrypted malware loader disguised as an Apple app.The Hacker NewsAttributed
The Hacker News said the Windows malware attempted to bypass User Account Control using UACME's ucmDebugObjectMethod().The Hacker NewsAttributed
The Hacker News said the Windows malware patched AMSI and ETW and unhooked ntdll.dll to blind endpoint security tools.The Hacker NewsAttributed
Cymulate said malware developers use system calls to avoid hooks implemented by modern security tools such as EDRs.CymulateAttributed
Cymulate demonstrated that a suspended process can provide an unhooked copy of ntdll.dll because EDR libraries are not loaded initially.CymulateConfirmed
Cymulate said its technique bypassed detection, unhooked ntdll, and loaded shellcode successfully against some EDRs.CymulateConfirmed
elastic.co published its report on Oct 12, 2026.elastic.coConfirmed
cymulate.com published its report on Nov 17, 2022.cymulate.comConfirmed

Could not verify

  • Whether the packages were used successfully against victims is not established
  • How many users or organizations were affected is not established
  • Whether the operation is linked to a specific actor or country is not established
  • Whether the attacker-controlled infrastructure substituted malicious model responses is not established
agents
See all in Agent Security →
Explore with AI
ChatGPT
Claude
Perplexity
Grok