Fake Web3 accelerator used npm packages to target AI agents with malware
Elastic Security Labs says Apex Accelerator packages delivered stealers, backdoors and attacker-controlled AI infrastructure to Windows and macOS users.
A fake Web3 accelerator called Apex Accelerator has been linked to malicious npm packages that delivered information stealers and backdoors to Windows and macOS systems, according to Elastic Security Labs. 12 The operation presented free AI credits, coding tools and security audits as a route into cryptocurrency start-ups and their founders.
What the packages were doing
Elastic said the packages included `@apexacc/cli`, advertised as an AI adviser for Web3 founders, and `@apexacc/audit`, presented as an MCP server with 18 security tools. Instead of providing the promised functionality, the audit package generated fabricated findings while the CLI’s scoring system assessed fictitious projects. 12
The campaign also delivered platform-specific malware. Elastic described CloudSyncD on macOS and a custom Windows information stealer that could collect system data, clipboard contents, screenshots, browser information, wallet data and other credentials before sending material through Telegram. The researchers said the packages were published by an npm user named “apexaccelerator” and linked to a GitHub account associated with the Apex Foundation. 1
The more unusual part of the operation targeted AI-agent traffic itself. The packages could intercept and redirect OpenRouter model requests, while registering an attacker-controlled MCP server in the victim’s agent configuration. That could expose prompts, conversation history, code snippets and tool outputs, while also giving the attacker a way to add instructions, tool descriptions and inputs to the agent’s context. 12
Elastic said the operation used a convincing public presence, including an Apex Arena workspace and appearances at industry events, to manufacture legitimacy. It also cautioned that Russian-language comments found in source-code history were not enough to establish who was behind the campaign. 1
Our opinion
The important warning here is not simply “be careful with npm”. It is that an apparently useful developer tool can be both the delivery mechanism and the surveillance layer. An AI agent already has access to valuable prompts, files and tools; handing that agent an unverified MCP server can turn a package install into a supply-chain compromise with a much wider blast radius.
Teams should treat free credits, urgent audits and unfamiliar agent integrations as untrusted software until the publisher, package contents and network behaviour have been checked independently. A polished accelerator website is presentation, not proof.