Fake Web3 Accelerator Distributes Malicious npm Packages to Steal Data
Threat actors posing as an accelerator used free AI credits to lure crypto founders into installing macOS backdoors and Windows stealers via fraudulent packages.
Key points
- Impersonators offered free Claude and Gemini credits alongside smart-contract audits to cryptocurrency startups and developers.
- Malicious npm packages installed platform-specific backdoors and information stealers that contacted attacker-controlled infrastructure.
- Elastic Security Labs identified the campaign, noting the abuse of the legitimate Oh My Pi coding agent project for cover.
Threat actors operating under the guise of a Web3 venture-capital accelerator distributed malicious software to cryptocurrency founders and developers. According to GBHackers, the campaign lured victims with offers of free AI coding credits and security audits.
The group, identified by Elastic Security Labs as Apex Arena and Apex, claimed to have raised over $124 million. They asserted support for more than 200 portfolio projects while promoting founder assessments and investor relations messaging.
Campaign Mechanics and Deception
Behind the polished public presence, the operators distributed compromised npm packages. These packages were designed to install backdoors on macOS systems and information stealers on Windows machines. Rather than providing legitimate services, the software downloaded platform-specific executables.
The malicious files contacted infrastructure controlled by the attackers and executed commands selected remotely. Elastic found that the attackers modified the legitimate Oh My Pi multi-provider coding agent. This real project served as effective cover for the malicious fork distributed in the campaign.
A critical component involved a bootstrap mechanism that redirected traffic. Specifically, the package redirected OpenRouter-labelled model traffic through infrastructure controlled by the Apex group. This gave operators potential access to prompts, conversation history, code snippets, and tool outputs submitted through the AI assistant.
Expanded Control Surface
The modified client persistently registered an attacker-controlled Model Context Protocol server. MCP servers can expose tools and instructions to AI clients. In this scenario, the remote server could provide attacker-controlled tool descriptions and prompt instructions to the victim’s system.
Elastic warned that this mechanism expanded the campaign’s control surface. It allowed the actors to observe large language model requests and potentially influence subsequent tool use. This capability gave operators potential access to submitted data.
Who Is Affected
The campaign specifically targeted cryptocurrency start-ups, developers, and founders. The attackers promoted job listings, direct investor-relations messaging, and smart-contract security audits to appear credible. They also used fake reviews and event invitations to bolster their legitimacy.
A separate package, labeled @apexacc/audit, claimed to provide eighteen Web3 security-testing functions. These included smart-contract auditing, honeypot analysis, and token-risk evaluation. However, testing revealed significant deception in the service’s capabilities.
What should you do?
Elastic submitted a fictitious project with no repository, team data, or market information to test the service. The system still returned an “Apex Score” of 51/100 across five categories. It acknowledged that its AI scoring system was unavailable, suggesting the score was a fabricated placeholder.
This indicates that the platform’s analytics were not functional. Investigators assessed the uniform score as a likely fabricated result intended to deceive users into trusting the service’s legitimacy.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: npm
- Verify the authenticity of npm packages before installation by checking official repositories and maintainer credentials.
- Monitor network traffic for unexpected connections to unknown or suspicious external infrastructure, especially from AI tools.
- Review installed applications for unauthorized Model Context Protocol servers or persistent background processes.
- Scrutinize offers of free credits or audits from unsolicited sources, particularly those claiming large fundraising amounts.
Step-by-step guide: Mistakes That Let Malicious npm Packages Compromise Your Build
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific software was used to distribute the malware in this campaign?
The attackers distributed malicious npm packages that installed macOS backdoors and Windows information stealers.
How did the attackers use the Oh My Pi project in their scheme?
They abused the legitimate Oh My Pi multi-provider coding agent as a cover for their malicious fork.
Did the Apex scoring system actually analyze submitted projects?
No, tests showed it returned fabricated scores even for fictitious projects with no data.
