Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders

A fake Web3 accelerator called Apex has been using malicious npm packages to target cryptocurrency start-ups and founders with what appeared to be free AI credits, coding tools, smart-contract audits, investment access, and invitations to in-person events.

Behind the polished Web3 pitch, the operation delivered malware for macOS and Windows, exposed AI-agent data to attacker-run systems, and provided false security results that could mislead teams into trusting unsafe code.

The campaign used two npm packages, @apexacc/cli and @apexacc/audit, presented as an AI coding agent and a Model Context Protocol (MCP) security-audit tool. Users who ran the packages through npm or npx could trigger a multistage infection chain.

The operation is especially concerning because crypto founders often handle wallet keys, source code, cloud credentials, investor data, and smart-contract material on the same developer systems.

Analysts at Elastic Security Labs identified the malicious @apexacc/cli package after a supply-chain monitor flagged suspicious behavior.

Their investigation linked it to a broader operation posing as the Apex accelerator and later found @apexacc/audit, another malicious package from the same publisher. The packages were malicious when published rather than being legitimate projects that were later compromised.

Fake Web3 Accelerator Uses Malicious npm Packages

Apex presented its main service as “Apex Arena,” a private workspace for Web3 founders. The site claimed more than 200 portfolio projects and more than $124 million raised.

It promoted smart-contract reviews, founder messaging, a directory of vetted talent, investment scoring, free Claude and Gemini credits, and the Apex Copilot coding tool.

The group also used fake reviews and advertised a physical event connected to TOKEN2049 in Singapore, a tactic designed to make the operation look like a real startup programme.

This mix of AI services, crypto branding, public repositories, and live-event activity shows how modern social-engineering campaigns can move beyond a simple phishing page.

Similar risks were seen in a malicious npm campaign targeting Web3 developers, where poisoned packages sought wallet phrases, API tokens, SSH keys, and cloud credentials.

Apex Copilot largely copied the legitimate open-source Oh My Pi coding agent. Elastic found that 1,351 of 1,363 compared source files matched the original project.

The altered code added a bootstrap component that could receive commands from Apex-controlled infrastructure, change AI service routing, and add an attacker-controlled MCP server to the victim’s configuration.

Malware Delivery on Windows and macOS

The npm package launchers used apex.cjs and audit.cjs to download platform-specific files from GitHub releases. On Windows, the code contacted vrf.apexaccs[.]org and received server-selected commands. It then created PowerShell and VBScript staging files before launching wscript.exe, PowerShell, and later malware stages.

The Windows chain led to a custom information stealer through bludness.exe, install.exe or exegis.exe, and updater_loader.exe. The final payload collected system details, clipboard data, screenshots, browser information, Wi-Fi profile names, files, and data from wallet, VPN, remote-access, messaging, and AI-client applications.

It also targeted Chrome, Edge, Firefox, and Yandex browser data, including saved credentials and cookies, before archiving collected material and sending it through Telegram.

On macOS, a Rust helper requested a command from the same verification service. The command fetched a script that delivered CloudSyncD, a backdoor which requested the user’s administrator password through a fake prompt and then collected host information before contacting its command-and-control server.

The CloudSyncD delivery method overlaps with the earlier fake Zoom installer CloudSyncD campaign, which also used a counterfeit installer and password prompt to run a privileged backdoor on macOS devices.

Apex Copilot changed OpenRouter-related environment settings so that model requests were sent to arena.apexaccs[.]org, rather than directly to the expected AI provider endpoint.

Elastic confirmed that prompts, conversation history, code snippets, local tool output, and available tool definitions could be sent to the Apex-controlled service.

The package also wrote an apex-copilot MCP entry into ~/.apex/agent/mcp.json, giving the remote server a lasting connection path across later sessions.

This is important because MCP tools may be allowed to read local files, call APIs, or run actions through AI clients. The danger follows a pattern documented in the first malicious MCP server discovery, in which a trojanized npm tool silently copied emails handled by an AI agent.

The second package, @apexacc/audit, claimed to offer 18 smart-contract security tools. Elastic found that every tool returned fabricated results rather than performing the stated checks. Some results were hard-coded, some inserted user-provided labels, and others used random or date-based values.

In one test, Apex’s remote scoring tool returned a score of 51/100 for a fictional project despite receiving no code repository, contract address, team data, or other evidence.

Teams should remove the two Apex packages from developer systems, review shell history and endpoint telemetry, and rotate secrets that may have been exposed.

This includes crypto wallet credentials, seed phrases, API keys, cloud tokens, GitHub credentials, browser sessions, SSH keys, and AI-service tokens.

Organisations should also examine AI-agent configuration files for unexpected MCP entries and review outbound connections to the listed domains.

Developers should verify npm publisher identity, repository ownership, release history, and package behavior before installing unfamiliar Web3 or AI tools.

npm lifecycle scripts can run during installation, while npm’s ignore-scripts setting prevents scripts declared in package.json from running; this can provide a safer review step, although explicitly invoked package commands can still execute.

Security teams should also alert on npm-launched PowerShell, VBScript, curl, or shell activity, especially when it creates files in temporary folders or downloads executable content.

Indicators of compromise (IoCs):-

Type	Indicator	Description
npm package	@apexacc/cli	Malicious Apex Copilot package
npm package	@apexacc/audit	Malicious Apex Audit MCP package
SHA-256	985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb	apex-windows-x64.exe
SHA-256	5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d	apex-audit-windows-x64.exe
SHA-256	42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e	apex-darwin-arm64
SHA-256	127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274	apex-verify-darwin
SHA-256	20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193	apex-audit-darwin-arm64
SHA-256	a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8	apex-audit-verify-darwin
SHA-256	68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71	CloudSyncD installer
SHA-256	ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b	exegis.exe
SHA-256	ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e	Encrypted enc_loader.exe
Domain	apexaccs[.]org	Apex Accelerator home page
Domain	arena.apexaccs[.]org	Onboarding portal, attacker-run LLM API, and MCP service
Domain	vrf.apexaccs[.]org	Verification service used to provide commands
Domain	verify.apexfdn[.]xyz	macOS installer script and CloudSyncD archive host
Domain	ccmihr[.]com	CloudSyncD command-and-control infrastructure
Domain	0auth-chromium[.]com	Windows PowerShell delivery script host
Domain	ehegisnightmare[.]icu	Windows loader executable host
Domain	arenapex[.]cloud	Earlier Windows script-download host
Domain	cloudmain365duo[.]top	Replaced Windows script-download host
Domain	fdn4apex[.]com	Later concealed Windows script-download host
Domain	main.router-apex[.]com	Earlier macOS updater-script host
Domain	update.apex-arena-router[.]com	macOS loader.sh host

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders appeared first on Cyber Security News.