A crypto accelerator that claimed more than 200 portfolio projects, $124 million raised and a presence at TOKEN2049 in Singapore was a malware operation, according to Elastic Security Labs. The group, which calls itself Apex, offered Web3 founders free Claude and Gemini credits, an AI coding assistant and smart-contract audit tools. The tools installed information stealers and backdoors on macOS and Windows, and the coding assistant routed users' AI conversations through servers the attackers control.
Elastic researchers Jia Yu Chan and Daniel Stepanic track the activity as REF8801 and describe it in the original report. The trail started when Elastic's supply-chain monitor flagged the npm package @apexacc/cli, which was malicious from the moment it was published rather than a compromised legitimate project. The same publisher had already appeared in an earlier campaign reported by SafeDep, and it soon published a second package, @apexacc/audit.
A real coding agent with a few extra files
@apexacc/cli, sold as "Apex Copilot", is a repackaged copy of the open-source coding agent Oh My Pi. Of 1,363 files in its agent directory, 1,351 matched the original exactly, so the tool genuinely works. The additions are what matter. A bootstrap swaps the OpenRouter settings so model requests labelled as OpenRouter go to arena[.]apexaccs[.]org, and registers an attacker-controlled MCP (Model Context Protocol) server in the agent's configuration, where it persists across restarts.
Elastic confirmed the effect in an instrumented session. After asking the agent to read a test file, the file's contents appeared in the next request sent to the attacker's endpoint. That gives the operators the prompts, conversation history, code and tool output a founder feeds the agent. The captured source also defaults tool approvals to "yolo", which Elastic notes could let substituted model responses drive local tools, although it did not observe that happening.
The audits were invented
The @apexacc/audit package promises 18 security tools delivered over MCP. Elastic found that every one returns hard-coded, date-derived or random output. Its honeypot check always reports "NOT A HONEYPOT", and its token risk score is a random number between 55 and 94 that can only ever read SAFE or WARN. Asked to score a fictitious project, the remote Apex scoring tool returned 51 out of 100 in every category while admitting its AI scorer was unavailable.
How the malware arrives
Both packages download platform-specific executables and ask vrf[.]apexaccs[.]org for a command to run. On macOS, a Rust helper fetches a script from verify[.]apexfdn[.]xyz that installs CloudSyncD, a backdoor previously documented by Jamf, which asks for the user's administrator password and profiles the host for its operators. On Windows, a chain of PowerShell, VBScript and loaders ends in a native stealer that takes browser data, crypto wallets, messenger and VPN data, screenshots and configuration files for Claude, Cursor and Windsurf, then sends the haul to Telegram. The audit package also asks for elevation to exclude its folder from Microsoft Defender scanning.
Commit history held a few Russian-language comments, but Elastic says such artifacts alone do not establish nationality or attribution. The group is not mapped to a known actor.
Vet the tool before you vet the deal
Teams that installed @apexacc/cli or @apexacc/audit should treat the machine as compromised, rotate wallet keys, browser sessions and AI service tokens, and remove the apex-copilot entry from ~/.apex/agent/mcp.json. Hosts worth blocking include:
- vrf[.]apexaccs[.]org and arena[.]apexaccs[.]org
- verify[.]apexfdn[.]xyz
- ehegisnightmare[.]icu
- fdn4apex[.]com, cloudmain365duo[.]top and arenapex[.]cloud
Elastic's report carries the full hash list and detection rules. The case follows other npm lures aimed at developers, including a stealer planted by a bug bounty hunter. What sets Apex apart is the patience: months of websites, reviews and conference appearances, built so that a founder's due diligence would come back clean.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.