Elastic Security Labs details REF8801’s fake Web3 accelerator and malicious npm packages

Elastic Security Labs published research exposing REF8801, a threat actor operating under the guise of Apex Accelerator. The group targeted cryptocurrency startups by offering free AI credits and security audits while distributing malicious software through npm packages.

The investigation began when a supply-chain monitor bot flagged suspicious behavior in the npm package @apexacc/cli. Researchers determined the package was malicious from its initial publication rather than being a compromised legitimate tool. This package was linked to a publisher previously reported by SafeDep.

View the original post on X

The Deception and Malware Delivery

The threat actors built a public presence for Apex Arena, a private workspace for Web3 founders. The website claimed over 200 portfolio projects and $124 million in raised capital to appear legitimate. The group advertised an in-person event through a dedicated invitation page to enhance credibility.

The operation delivered information-stealing malware and backdoors for both macOS and Windows machines. Campaigns distributed CloudSyncD malware for Apple systems and a custom Windows information stealer. The Windows malware exfiltrated stolen data through Telegram messaging channels.

Tools and Fabricated Audits

The group repackaged a legitimate coding agent to route model requests through attacker-controlled services. All 18 tools within the @apexacc/audit package returned fabricated security findings to users. In testing, the remote scoring service gave a fictitious project a score of 51 out of 100.

The Apex Copilot coding project contained a malicious backdoor that provided users with an Apex Score. The operation also used fake reviews to make its services appear trustworthy to researchers. The group sought legitimacy by appearing at TOKEN2049 in Singapore and other conferences.

What should you do?

Elastic Security Labs notified conference organizers of the activity before publishing this research. The researchers hope their findings raise awareness about scams using AI-generated code and websites. Illegitimate operations increasingly look polished and well-established due to these technologies.

Background: Malicious npm packages

Developers often ignore version pinning, skip package audits, and leave internal registries open. These errors allow attackers to push malicious code under similar names or older versions. Fix these gaps by enforcing strict version ranges, using private mirrors, and verifying package integrity before installation.

Read the full guide: Mistakes That Let Malicious npm Packages Compromise Your Build

What to do and how to stay safe: Elastic Security Labs

• Verify npm package publishers against known threat actor lists and SafeDep reports before installation.
• Inspect code repositories for unexpected network connections to attacker-controlled AI services.
• Monitor for CloudSyncD or custom Windows stealer indicators on macOS and Windows endpoints.
• Validate security audit results from third-party tools with independent verification methods.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is REF8801?

REF8801 is the threat actor group identified by Elastic Security Labs behind the fake Apex Accelerator operation and malicious npm packages.

Which npm packages were involved?

The investigation focused on @apexacc/cli and @apexacc/audit, which contained backdoors and fabricated audit tools.

How did the malware exfiltrate data?

The custom Windows information stealer exfiltrated data through Telegram, while macOS targets received CloudSyncD malware.