CONNECT WITH US
Cyber Security

Cyber Security

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

The Hacker News logo

Published on

Add as a preferred source on Google
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.

"The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic Security Labs researchers Jia Yu Chan and Daniel Stepanic said. "The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services, while its audit tools generated fabricated security findings."

The scheme poses as a Web3 venture capital accelerator named Apex Accelerator to target cryptocurrency startups and founders. It's being tracked under the moniker REF8801. The names of the npm packages, each of which targets both Windows and macOS machines, are listed below -

While both the packages and their associated GitHub repositories are no longer accessible, "@apexacc/cli" was advertised as an "AI advisor for Web3 founders" that's powered by Claude Fable 5 and Gemini 2.5 Flash.

"@apexacc/audit," on the other hand, claimed to be a Model Context Protocol (MCP) server exposing 18 security tools for scanning tokens, wallets, and smart contracts. Both packages were published by an npm user named "apexaccelerator" and linked to a GitHub account called "apexaccs" and an entity referred to as the Apex Foundation.

Interestingly, the campaign itself is not new.



Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.