Elastic Unmasks Apex Accelerator, a Fake Web3 Backer Whose Malicious npm AI Tools Hijack LLM Traffic and Drop Stealers

SINGAPORE - Elastic Security Labs on Oct. 12, 2026 published research on REF8801, an operation that posed as a Web3 venture accelerator called Apex and spent months courting cryptocurrency start-ups and founders with free Claude and Gemini credits, an AI coding assistant, and security audits. Researchers Jia Yu Chan and Daniel Stepanic say the tools behind those offers delivered information-stealing malware and backdoors for macOS and Windows, routed a coding agent's model requests through attacker-controlled services, and produced fabricated audit findings.

The investigation began with an alert from Elastic's own supply-chain monitor bot, which flagged the npm package @apexacc/cli. Elastic says the package was malicious from the moment it was published rather than the product of a hijacked maintainer, and that it tied back to a publisher in a campaign previously reported by SafeDep. The same actor then published a second package, @apexacc/audit. The front for both was Apex Arena, a private workspace for founders whose website claims more than 200 portfolio projects and more than $124 million raised. Elastic documents fake reviews, an event listing that was taken down for violating the host platform's terms, and a presence at TOKEN2049 in Singapore. Elastic says it notified the conference organizers before publication.

The coding assistant, sold as Apex Copilot, is a repackaged copy of the legitimate open-source agent Oh My Pi. Of 1,363 files in the Apex agent directory, 1,351 matched their Oh My Pi counterparts exactly. The additions are a bootstrap that runs server-selected commands from vrf.apexaccs[.]org, a redirect that sends OpenRouter-labeled model traffic to arena.apexaccs[.]org while the tool still shows OpenRouter as the provider, and a persistent entry in ~/.apex/agent/mcp.json that registers an attacker-controlled MCP server. In an instrumented session, Elastic watched a marker prompt reach the attacker endpoint along with 28 tool definitions, eight of them Apex-specific. The contents of a test file the agent was asked to read then appeared in the next request to that endpoint. The captured source defaults tool approvals to yolo, though Elastic says it did not observe malicious response substitution.

The audit package fared no better. Elastic says all 18 of its MCP tool handlers return hard-coded, input-formatted, date-derived, or randomized reports instead of running scans. One claims Slither v0.10.4 analyzed 847 lines of code, the honeypot check always answers NOT A HONEYPOT, and a token-risk score is drawn at random between 55 and 94. Asked to score a fictitious project with no repository or team details, the remote apex_score tool returned 51 out of 100 while reporting that its AI scorer was unavailable.

The payload chains split by platform. On macOS, a small Rust helper posts to the verification endpoint and receives a curl-to-shell command that fetches CloudSyncD, a backdoor previously described by Jamf. It prompts for the administrator password, validates it with dscl, and beacons a ChaCha-encrypted host profile to ccmihr[.]com. On Windows, the bootstrap writes PowerShell and VBScript launchers, and the audit package requests elevation to exclude its folder from Microsoft Defender scanning and attempts to switch off Smart App Control. The chain runs through a PyInstaller loader with a UAC bypass, a PyArmor-protected stage with anti-VM checks, and a Go loader that tries to restore a clean ntdll from a suspended Notepad process and patch ETW functions. In Elastic's own run, the first-stage loader stopped on a missing Python dependency, but the researchers recovered and analyzed the later stages. Its final stage is a native stealer that collects browser secrets, including Chrome App-Bound Encryption keys, along with Claude, Cursor, and Windsurf configuration files, and sends archives to Telegram bots.

For SOC teams, Elastic's write-up gives concrete hunting ground. It publishes hashes and more than a dozen domains, including the rotated download hosts arenapex[.]cloud, cloudmain365duo[.]top, and fdn4apex[.]com, and it lists endpoint rules such as Suspicious PowerShell from npm Package Install, Curl Download Activity from npm Package Install, and Evasion via Event Tracing for Windows Patching. Host artifacts worth sweeping include the apex-copilot entry in mcp.json, an OPENROUTER_BASE_URL pointing at apexaccs[.]org, _apex_run or _audit_run scripts under %TEMP%, and the %APPDATA%\.cobra marker. Elastic notes that Russian-language comments in the commit history do not by themselves establish attribution. Its broader warning is that AI-generated code, websites, and portfolios increasingly make illegitimate operations look polished and well established. In REF8801, the lure and the collection point were the same thing: the AI tooling founders were invited to install.