A deceptive operation posing as a Web3 accelerator has been identified distributing malware through npm packages on both Windows and macOS systems. This scheme, under the guise of offering free AI credits for platforms like Anthropic Claude and Google Gemini, as well as coding tools and security audits, has been spreading information-stealing malware and backdoors.
Malicious npm Packages Target Web3 Community
Researchers from Elastic Security Labs, Jia Yu Chan and Daniel Stepanic, have highlighted how these packages, disguised as legitimate coding tools, repurpose a genuine agent to send requests via attacker-controlled services. These packages, named @apexacc/cli and @apexacc/audit, falsely advertise themselves as tools for AI advisors and security scanning within the Web3 ecosystem.
Although these packages and their associated GitHub repositories are now inaccessible, they were previously marketed as essential tools for Web3 founders. The operation, tracked as REF8801, targets cryptocurrency startups and founders with promises of venture capital acceleration.
Historical Context and Attack Methodology
This malicious campaign is not a recent development. SafeDep, in July 2026, detailed additional npm packages linked to this operation, which were distributing a macOS stealer from the Atomic Stealer family. The Apex Foundation, allegedly behind this campaign, has been associated with multiple domains since April 2026, offering investments and partnerships to projects that meet certain criteria.
The attackers approached developers of cryptocurrency wallets and market intelligence tools with investment offers, instructing them to use their due diligence tool, which actually deployed malware disguised as legitimate applications.
Technical Details of the Malware
Once installed, the npm packages do not deliver the promised functionality. Instead, they install a macOS backdoor called CloudSyncD and a Windows information stealer that exfiltrates data via Telegram. Each package implements a distinct verification path for different operating systems to initiate malware deployment.
On Windows, the malware retrieves and executes a series of scripts and executables that collect system data and bypass security measures. Meanwhile, the macOS variant downloads a bash script that installs a backdoor capable of phishing system credentials and transmitting data to external servers.
CloudSyncD, first documented by Jamf Threat Labs, demonstrates an increasing trend in macOS malware towards native implementations and evasive techniques while relying on traditional methods like password phishing.
Implications and Future Outlook
This sophisticated attack highlights the growing threat of malicious npm packages targeting cryptocurrency and AI platforms. As the cybersecurity landscape evolves, such campaigns underline the importance of vigilance and robust security practices for developers and startups in the Web3 space. Ongoing research and awareness are crucial to mitigating these risks and protecting against future threats.
