Fake Apex Web3 accelerator spreads malware via npm packages
Elastic Security Labs found a fake Web3 accelerator called Apex that lured crypto founders with free AI credits and audits, then spread Windows and macOS malware through two malicious npm packages.
- First reported
- Reports
- 1
Source: cybersecuritynews.com · published
What happened
Cyber Security News reported on October 13, 2026 that a fake Web3 accelerator called Apex targeted cryptocurrency start-ups and founders with offers of free AI credits, coding tools, smart-contract audits, investment access and invitations to in-person events. Analysts at Elastic Security Labs identified the campaign after a supply-chain monitor flagged a suspicious npm package.
Two packages were involved: @apexacc/cli, presented as an AI coding agent called Apex Copilot, and @apexacc/audit, presented as a smart-contract security-audit tool. Elastic found the packages were malicious from the day they were published.
How the scam works
Apex's main site, branded Apex Arena, claimed more than 200 portfolio projects and more than $124 million raised, used fake reviews, and advertised an event linked to TOKEN2049 in Singapore to look like a real start-up programme.
Running the packages started a multistage infection. On Windows it ended in an information stealer that collected browser passwords and cookies, screenshots, clipboard data, files and data from wallet, VPN, messaging and AI apps, then sent it out through Telegram. On macOS it delivered CloudSyncD, a backdoor that asked for the administrator password through a fake prompt.
Apex Copilot also rerouted AI requests to arena.apexaccs.org, exposing prompts, code and tool output, and added an attacker-controlled MCP server to the user's configuration. The audit package's 18 "security tools" returned fabricated results instead of real checks.
Other domains listed as indicators include vrf.apexaccs.org, verify.apexfdn.xyz and ccmihr.com.
Source
Cyber Security News, "Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders" (October 13, 2026), reporting Elastic Security Labs research.
Red flags
- An accelerator or grant programme that asks you to install its own CLI or npm package before you can join.
- Free AI credits, audits or investor access offered to founders with little vetting.
- Security-audit tools that return scores without being given any code or contract.
- npm packages from a new publisher with no history, launched with npx.
If you were targeted
- 1Remove @apexacc/cli and @apexacc/audit from any machine that installed them.
- 2Assume secrets on that machine are exposed: rotate wallet keys and seed phrases, API keys, cloud and GitHub tokens, SSH keys and browser sessions.
- 3Check AI-agent configuration files (for example ~/.apex/agent/mcp.json) for unexpected MCP server entries.
- 4Review outbound connections to the listed domains and report the incident to the FBI at ic3.gov.