Full Report
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Analysis Summary
# Tool/Technique: REF8801 (Apex Accelerator npm Campaign)
## Overview
REF8801 is a social-engineering and supply-chain campaign run by a fake Web3 venture accelerator, "Apex Accelerator," tied to the "Apex Foundation." It targets cryptocurrency startups, founders, wallet developers, and traders. The operators distribute malicious npm packages that promise free AI credits (Anthropic Claude, Google Gemini), coding tools, and security audit utilities. The packages deliver information stealers and backdoors to both Windows and macOS. Per Elastic Security Labs, the operation also repackaged a legitimate coding agent to route model requests through attacker-controlled services, and its audit tools generate fabricated security findings. The packages and GitHub repositories are no longer accessible.
## Technical Details
- Type: Campaign (malicious npm packages delivering an infostealer and backdoor; the article also describes a repackaged legitimate tool)
- Platform: Windows, macOS
- Capabilities (as reported):
- Information stealing, with Windows data exfiltrated over Telegram
- macOS backdoor (CloudSyncD)
- Encrypted loader disguised as an Apple component (`com.apple.system.loader`)
- Platform-specific payload retrieval from GitHub releases
- Fake tool functionality to maintain the lure
- Traffic hijacking of AI model requests via attacker-controlled services
- First Seen: Infrastructure linked to the foundation since approximately March–April 2026 (domain snapshots from March 19, 2026). A related npm campaign with macOS Atomic Stealer (AMOS) payloads was reported by SafeDep in late July 2026. Elastic's report was published around October 19, 2026.
## MITRE ATT&CK Mapping
*Mappings below are my analysis based on the reported behavior. The article does not list ATT&CK IDs, and the truncated text omits some infection-chain details.*
- TA0001 - Initial Access
- T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools (malicious npm packages)
- TA0002 - Execution
- T1204.002 - User Execution: Malicious File (developer installs package)
- T1059.007 - Command and Scripting Interpreter: JavaScript (Node.js package execution)
- TA0003 - Persistence
- T1543 - Create or Modify System Process (macOS backdoor, likely; confirm against the full report)
- TA0005 - Defense Evasion
- T1036 - Masquerading (loader disguised as an Apple system component)
- T1027 - Obfuscated/Encrypted Files or Information (encrypted loader)
- TA0006 - Credential Access
- T1555 - Credentials from Password Stores (typical for infostealers targeting wallets and browsers; verify)
- TA0009 - Collection
- T1005 - Data from Local System
- TA0011 - Command and Control
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP POST verification requests)
- TA0010 - Exfiltration
- T1567 - Exfiltration Over Web Service (Telegram)
- TA0042 - Resource Development
- T1583.006 - Acquire Infrastructure: Web Services (GitHub used for payload hosting)
- T1585.001 - Establish Accounts: Social Media Accounts (X/Twitter outreach)
## Functionality
### Core Capabilities
- Presents as a Web3 accelerator offering free AI credits, coding tools, and security audits
- Installs via npm packages (`@apexacc/cli`, `@apexacc/audit`, `@apexfdn/apex`, `@copilot-mcp/apex`, `@apexfdn/copilot-mcp`)
- Sends an HTTP POST with the platform identifier (`win32` or `darwin`) to a verification endpoint to choose the next stage
- Retrieves platform-specific executables from GitHub releases
- Windows: custom infostealer exfiltrating data via Telegram
- macOS: CloudSyncD backdoor, plus Atomic Stealer (AMOS) in the earlier campaign
### Advanced Features
- Dual-platform package design with separate Windows and macOS verification paths
- Fake functional output (fabricated audit findings; unsupported assessment of a fictitious project) to sustain the lure
- Repackaged legitimate coding agent that redirects model API traffic to attacker-controlled services
- Encrypted loader disguised as an Apple system component
- Social engineering via in-person credibility (TOKEN2049 Singapore presence) and direct investment offers ($235,000 claimed)
- Targeted outreach to developers of crypto wallets and trading intelligence tools
## Indicators of Compromise
*Hashes and full infection-chain artifacts were not included in the provided text. Consult the Elastic Security Labs report and the SafeDep and Socket publications for complete IOCs.*
- File Hashes: Not provided in the article
- File Names:
- `com.apple.system.loader` (disguised macOS loader)
- CloudSyncD (macOS backdoor)
- Registry Keys: Not applicable (macOS/Windows; not specified in text)
- Network Indicators (defanged):
- Domains: `apexaccs[.]org`, `apexfdn[.]xyz`
- Verification endpoint: `vrf.apexaccs[.]org` (path `/api/v1/vrf`)
- Developer accounts: npm user `apexaccelerator`; GitHub user `apexaccs` (hxxps://github[.]com/apexaccs)
- Telegram (exfiltration channel; specific bot/channel identifiers not provided)
- Package Names (npm):
- `@apexacc/cli`
- `@apexacc/audit`
- `@apexfdn/apex`
- `@copilot-mcp/apex`
- `@apexfdn/copilot-mcp`
- Behavioral Indicators:
- Post-install npm scripts that fetch remote executables
- HTTP POST requests containing `win32` or `darwin` to the verification endpoint
- Download of binaries from GitHub releases shortly after package installation
- Outbound traffic to the Telegram API from developer workstations
- Unexpected loader execution from user directories masquerading as Apple components
## Associated Threat Actors
- REF8801 (Elastic Security Labs tracking designation)
- "Apex Accelerator" / "Apex Foundation" (self-described entity; likely a fake front)
- Overlap with the actor distributing AMOS via npm, per SafeDep reporting (attribution confidence not stated)
## Detection Methods
**Signature-based**
- Block or alert on the listed npm package names and the associated domains.
- Alert on DNS or HTTP requests to `apexaccs[.]org`, `apexfdn[.]xyz`, and `vrf.apexaccs[.]org`.
- Scan for `com.apple.system.loader` and CloudSyncD on macOS endpoints.
- Scan `node_modules` trees for the listed packages.
**Behavioral**
- Flag npm lifecycle scripts (`preinstall`, `postinstall`) that download and execute binaries.
- Flag Node.js processes spawning shell commands, or writing and executing unsigned binaries.
- Flag macOS binaries under non-standard paths named to mimic Apple components.
- Flag outbound HTTP POST requests containing platform strings to unfamiliar domains.
- Flag Telegram API traffic from non-messaging processes.
**YARA**
- No public YARA rules were referenced in the provided text. Check the Elastic report for rules.
## Mitigation Strategies
**Prevention**
- Do not install packages based on promotional offers, including "free AI credits" or audit tools from unknown sources.
- Verify package publishers, maintainer history, and repository age before installing (e.g., via Socket, Phylum, or npm provenance checks).
- Use lockfiles and pin dependency versions. Review new dependencies before adoption.
- Block or restrict Telegram API access from developer and build environments where feasible.
**Hardening**
- Disable or restrict npm lifecycle scripts (`npm config set ignore-scripts true`) in developer environments, and allow exceptions only as needed.
- Run package installs in isolated containers or ephemeral VMs.
- Enforce application allowlisting on macOS (Gatekeeper, notarization checks) and Windows (AppLocker or WDAC).
- Use egress filtering to limit developer workstations' outbound connections.
- Store wallet keys and secrets in hardware wallets or dedicated secret managers, not on workstations that run untrusted code.
- Rotate credentials and wallet keys if a developer machine is suspected of installing these packages.
- Train founders and developers to treat unsolicited investment or "free credit" outreach as a potential lure, and to verify organizations independently.
## Related Tools/Techniques
- Atomic Stealer (AMOS): macOS infostealer also delivered in this campaign
- Malicious npm supply-chain campaigns (e.g., typosquatting and dependency confusion attacks targeting developers)
- Fake recruiter and "technical assessment" npm lures targeting crypto developers (e.g., BeaverTail/InvisibleFerret-style campaigns, DPRK-linked)
- Telegram-exfiltrating Windows infostealers
- Fake AI tool and MCP server lures (a growing pattern as AI developer tooling expands)