REF8801

Everything Threat Times has reported about REF8801: 2 stories, newest first. Part of our Data Breaches coverage.

Cyber Attacks

Fake Web3 Accelerator Uses npm Packages to Distribute Malware to Windows and macOS Systems

Threat TimesOct 19, 2026

Attackers posing as a Web3 venture accelerator pushed malicious npm packages promising free AI credits, delivering stealers and backdoors to developer machines.

Data Breaches

Elastic Security Labs details REF8801’s fake Web3 accelerator and malicious npm packages

Threat TimesOct 12, 2026

Researchers found Apex Accelerator used fake audits and AI tools to deliver malware to crypto startups via compromised npm packages.