Fake Web3 Accelerator Uses npm Packages to Distribute Malware to Windows and macOS Systems

Elastic Security Labs researchers reported that threat actors operating under the REF8801 moniker have distributed information stealers and backdoors through malicious npm packages. The campaign targets developers on both Windows and macOS systems by impersonating a Web3 venture capital accelerator named Apex Accelerator to gain trust.

The attackers offered free artificial intelligence credits for Anthropic Claude and Google Gemini alongside coding tools and security audits to entice victims. According to Elastic, the delivered tools installed information-stealing malware and backdoors on infected machines. The operation also repackaged a legitimate coding agent to route model requests through attacker-controlled services while generating fabricated security findings in its audit tools.

Operational Context and Package Details

The malicious packages were published by an npm user named "apexaccelerator" and linked to a GitHub account called "apexaccs" and an entity referred to as the Apex Foundation. The primary packages identified were @apexacc/cli, advertised as an AI advisor for Web3 founders, and @apexacc/audit, which claimed to be a Model Context Protocol server for security scanning.

Both packages are no longer accessible on npm, and their associated GitHub repositories have been removed. However, artifacts captured by Socket indicate that the Apex Foundation has been linked to at least two distinct domains since April 2026. SafeDep previously detailed three other npm packages linked to this same operation in late July 2026, including @copilot-mcp/apex and @apexfdn/copilot-mcp, which distributed macOS stealers belonging to the Atomic Stealer family.

Attribution Challenges and Target Profile

It remains unclear who is behind the REF8801 operation. Elastic Security Labs noted the presence of Russian-language comments in the source code commit history of the malicious packages. However, the researchers stated that these clues alone are not sufficient to definitively establish the identity or origins of the threat actors behind the campaign.

The scheme specifically targets cryptocurrency startups and founders. By posing as an accelerator, the attackers leveraged the desire for early-stage funding and resources. The promise of free AI credits and specialized Web3 security tools served as the primary lure for victims to install the compromised software on their development environments.

What should you do?

Security teams should monitor npm package installations for any packages associated with the Apex Accelerator or Apex Foundation entities. Organizations should review their software supply chain for unauthorized dependencies, particularly those claiming to offer free AI services or credits. Developers should verify the provenance of any npm packages before installation and check for known malicious hashes or repository links.

Background: Malicious npm packages

Developers often ignore version pinning, skip package audits, and leave internal registries open. These errors allow attackers to push malicious code under similar names or older versions. Fix these gaps by enforcing strict version ranges, using private mirrors, and verifying package integrity before installation.

Read the full guide: Mistakes That Let Malicious npm Packages Compromise Your Build

What to do and how to stay safe: npm

• Audit your npm dependencies regularly to remove any packages associated with the Apex Accelerator or similar fake entities.
• Monitor network traffic for unexpected connections to attacker-controlled services that may indicate repackaged agent abuse.
• Verify the authenticity of any tools promising free AI credits or security audits before installation on development machines.
• Keep your operating systems and security software updated to detect and block known information stealers and backdoors.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What specific npm packages were involved in the REF8801 malware campaign?

The primary packages identified were @apexacc/cli and @apexacc/audit, published by the user "apexaccelerator".

Did the attackers successfully attribute to a specific country or group?

No, while Russian-language comments were found in the source code, Elastic Security Labs stated this was not enough to definitively establish identity or origins.

Are the malicious npm packages still available for download?

No, both the packages and their associated GitHub repositories are no longer accessible according to the report.