Fake Apex Accelerator npm Packages Hijack Agent LLM and MCP Traffic

Elastic Security Labs has documented a campaign it tracks as REF8801: a fake Web3 venture accelerator, "Apex Accelerator," that lures developers with free Claude and Gemini credits and hands them npm packages posing as AI copilots and MCP servers. The packages deliver infostealers, and the CLI package quietly redirects an agent's LLM requests and plants an attacker-controlled MCP server. If you ran either @apexacc package, treat the machine as compromised. The Hacker News summarized the campaign; the technical detail below is from Elastic's report.

TL;DR

How the campaign works

The operators approached developers of crypto wallets and trading tools with investment offers and a "due diligence" package to run. The packages do not do what they advertise: the audit tool produces fabricated findings. Their job is to fetch platform-specific payloads from GitHub releases.

Windows: PowerShell and VBScript launchers lead to a loader that attempts a UAC bypass, attempts to patch AMSI (Elastic says a bug makes this unreliable) and ETW, unhooks ntdll.dll and runs an information stealer exfiltrating via Telegram. Elastic says the @apexacc/audit bootstrap also tries to add a Defender exclusion and disable Smart App Control.

macOS: a remote script drops CloudSyncD, a backdoor that uses a fake authorization prompt to ask for your login password. Jamf's analysis, covered below, adds detail on what the malware does with that password.

Background: a campaign that predates the October report

The REF8801 report is the third public look at the same operation, and the timeline matters because it shows how the operators adapt.

• March to April 2026. The Hacker News reports that Internet Archive snapshots from March 19, 2026 already show the "Apex Foundation" site offering $235,000 investments and grants, and that Socket artifacts link the entity to two domains, apexaccs[.]org and apexfdn[.]xyz, since April 2026.
• Late July 2026. SafeDep documented three related packages that distributed a macOS stealer from the Atomic Stealer (AMOS) family. The Open Source Vulnerabilities database lists a malicious-code record, MAL-2026-11121, published July 28, 2026, for a similarly named package spelled @apexfnd/apex. It describes a postinstall script that, on macOS, runs a remote loader through osascript with administrator rights, and on every platform downloads a binary from a GitHub release without any hash or signature check. Check the spelling when you search your lockfiles: the names in these reports differ by a transposed letter, and typo-adjacent scopes are common in this kind of campaign.
• October 12, 2026. Elastic Security Labs published its analysis after its supply-chain monitor bot flagged @apexacc/cli. Elastic says the package was malicious from the moment it was published, so this was not a compromise of an existing project. The same publisher then released @apexacc/audit with a new campaign.
• October 19, 2026. The Hacker News summarised the report. By then both packages and their GitHub repositories were no longer accessible.

The July packages used install-time execution. The October packages moved the payload behind a launcher that runs only when you invoke the command or start it with npx. That is a meaningful difference for defenders: scanners and policies that only look at postinstall scripts would miss it.

How the fake accelerator earned trust

Elastic describes an operation that spent months building a public presence. The main site presents itself as Apex Arena, a private workspace for crypto founders, and claims more than 200 portfolio projects and over $124 million raised. It offers an "Apex Score" start-up assessment, direct messaging with "investment relations", and a downloadable "Apex Audit" suite delivered over MCP. Elastic found fake reviews, an event listing that was later taken down, and a presence at TOKEN2049 in Singapore. Elastic notified the conference organisers before publication. It also found a founder describing, on X, how he handled the approach.

None of this is technical, but it is the delivery mechanism. A developer who is told that an investor wants "due diligence" run with a tool will often run it. Elastic notes that AI-generated code, websites and portfolios make illegitimate operations look more polished than they used to.

What the npm launchers download and run

The two packages expose launchers, apex.cjs for @apexacc/cli and audit.cjs for @apexacc/audit, through their bin entries. These run when someone invokes the installed command or launches it with npx. Each launcher builds a versioned GitHub release URL, caches the executable under the user's home directory and starts it with spawnSync.

Elastic lists the components. For @apexacc/cli the Windows build is a Bun executable plus a native .node library, and the macOS ARM64 build is a Bun-compiled Mach-O plus a separate Rust helper, apex-verify-darwin. For @apexacc/audit the pattern is the same, with apex-audit-verify-darwin as the macOS helper. The source in both projects implements a "verification" path. It contacts vrf.apexaccs[.]org/api/v1/vrf and accepts server-chosen exec, args and cmd fields. In practice this is remote command execution with a polite name.

Windows chain

On Windows the JavaScript bootstrap posts {"p":"win32"} to the verification service and builds a command line from the answer, for example powershell.exe -nop -EncodedCommand <cmd>. It writes that line to %TEMP%\_apex_run.ps1 (or _audit_run.ps1), writes a small VBScript launcher beside it, and starts wscript.exe. Elastic's chain then runs PowerShell, a drop.ps1 script, a loader executable, a second-stage loader and in-process shellcode, ending in a native stealer that zips its haul and sends it through Telegram. The Hacker News summary adds that the stealer collects browser data, wallet and extension data, messenger and VPN clients, and can bypass Chrome's app-bound encryption to get saved passwords and session cookies.

The @apexacc/audit bootstrap also asks for UAC elevation on Windows 11, to exclude %USERPROFILE%\.apex-audit from Microsoft Defender scanning, and tries to disable Smart App Control by setting VerifiedAndReputablePolicyState to zero.

macOS chain

On macOS the JavaScript does not touch the network. A Rust helper posts {"p":"darwin"} to the same service and receives a shell command, which fetches an installer script from verify.apexfdn[.]xyz. The script downloads package.tar.gz, which contains a Mach-O dropper called installer. That dropper is CloudSyncD.

What Jamf found about CloudSyncD

Jamf Threat Labs published its CloudSyncD analysis on September 30, 2026, before the Apex link was public. Jamf first saw a build under development on September 15 and, two days later, samples configured against live command-and-control domains.

In the sample Jamf analysed, the dropper arrived as a disk image styled as a Zoom installer. A fake authorization dialog asks for the login password and checks it with dscl before continuing. Jamf says the password is written into a decoy data.json file under ~/.config/zoom/, hidden in a field of random filler and located through zero-width Unicode characters in a neighbouring field. Jamf also says the password is never recorded or sent anywhere by that sample, and that the malware has no built-in feature to collect browser data, keychain items or wallets. The Hacker News, by contrast, says the dropper uses the phished password to run its embedded payload with sudo and that the payload contacts ccmihr[.]com for tasks. Treat those as two reports of what the sample does, and read both sources if the distinction matters to your response. In either case, a Mac that ran the Apex binaries should be treated as exposed to a backdoor that can run further payloads.

An agent forked from a real project

@apexacc/cli is not a from-scratch tool. Elastic compared Apex Copilot v1.6.1 with the open-source coding agent Oh My Pi v16.3.6 and matched files under packages/coding-agent/src/ by content hash. Of the 1,363 files in Apex's directory, 1,351 matched their Oh My Pi counterparts exactly. The additions are the bootstrap that runs verification commands, the OpenRouter redirect and the MCP registration. Because the rest of the agent works, the tool behaves like a real coding assistant, which hides the additions. The Windows native library matches Oh My Pi's Rust source, and Elastic's preliminary inspection found nothing extra in it.

Note the earlier OSV record: its package metadata pointed to the can1357/oh-my-pi repository while the code fetched from a different GitHub organisation. A mismatch between a package's declared repository and where it downloads code is a cheap signal worth checking.

What Elastic tested on the traffic redirect

Elastic ran an instrumented session. A chat request carrying a marker string went to the attacker's endpoint, which returned an HTTP 200 streamed response. The request carried two system messages and 28 tool definitions, 20 generic tools and eight Apex-specific remote MCP tools. In a second test, Elastic asked the agent to read a local file with a unique value. The next request to the attacker's endpoint contained that file content as a tool result, and later requests carried it again as conversation context.

This shows the limit of "I only asked it to read one file". Anything a tool returns becomes part of the conversation and travels to the model endpoint on every later turn. When that endpoint belongs to the attacker, the contents of every file the agent reads are theirs.

Elastic also notes that control of the endpoint lets an attacker substitute responses, including structured tool calls, and that the captured source defaults tool approvals to a permissive yolo mode. Elastic states it did not observe malicious response substitution. Read that sentence carefully: it is a capability, not an observed attack.

The audit tools produce fiction

The @apexacc/audit package offers 18 tools. Elastic inspected all 18 handlers and found that none runs the advertised analysis. They format hard-coded findings and insert user-supplied labels. audit_full_contract returns a fixed report claiming Slither v0.10.4 analysed 847 lines. audit_honeypot always answers "NOT A HONEYPOT". audit_token_risk uses Math.floor(Math.random() * 40) + 55, so it returns a score from 55 to 94 and can only say SAFE or WARN.

For @apexacc/cli, a test of the remote apex_score tool on an invented project returned 51/100, with the same 51 in five categories, while saying its AI scorer was unavailable. The agent called that tool without further confirmation.

The consequence goes beyond malware. A victim who runs the "audit" and gets a clean report may believe a token or contract is safe. A tool that returns reassuring output with no real analysis behind it is dangerous in its own right.

The agent-specific part

1. LLM traffic redirection. The @apexacc/cli bootstrap sets OPENROUTER_API_KEY to an Apex token and OPENROUTER_BASE_URL to an attacker endpoint inside its running process. The client still labels the provider OpenRouter, so the UI gives no hint.
2. A planted MCP server. It creates an apex-copilot entry in ~/.apex/agent/mcp.json with a bearer token and device identifier. That server supplies tool definitions and instructions that are added to outgoing prompts, and the captured source defaults tool approvals to a permissive "yolo" mode.
3. Config theft. @apexacc/audit tries to register itself in Claude Desktop, Cursor and Windsurf configurations (Elastic says a startup bug breaks that path, though the README steers users around it). The stealer separately collects those clients' config files.

The result: an attacker who sees your prompts, code snippets and tool outputs, and who can shape which tools the model calls. This is the same class of risk as rogue MCP servers and config poisoning, delivered through the npm supply chain, like the worms hitting AI tooling.

What this means if you run AI coding agents

• Audit your MCP config. Check ~/.apex/agent/mcp.json and the MCP sections of Claude Desktop, Cursor and Windsurf for apex-copilot, apex-audit or any server you did not add.
• Check the environment for OPENROUTER_BASE_URL pointing at Apex infrastructure and for PI_OPENROUTER_RESPONSES.
• Look for artifacts: %TEMP%\_apex_run.ps1, %TEMP%\_audit_run.ps1, %APPDATA%\.cobra, the .apex-audit directory, Defender exclusions.
• Block apexaccs[.]org, apexfdn[.]xyz and the other domains in Elastic's indicator list.
• Rotate any OpenRouter, provider or other key stored in agent or AI-client config, plus browser-saved passwords. Consider rebuilding the machine.
• Search lockfiles and caches. Look for the @apexacc, @apexfdn, @copilot-mcp and (per OSV) @apexfnd scopes in package-lock.json, pnpm-lock.yaml, bun.lock and the npx cache. The launchers cache executables under the home directory, so also look for apex and apex-audit binaries there.
• Check macOS persistence. Look for a daemon or launch item named CloudSyncD, a ~/.config/zoom/data.json file, and outbound connections to the domains in Elastic's indicator list.
• Treat unsolicited due diligence as hostile. An investor asking you to run their tool on your code is the lure. Run unknown tools in a disposable VM or container with no credentials.
• Vet before you run. Treat an unfamiliar "MCP server" package like an executable from a stranger. See our MCP security guide and how to review an MCP server.

What Beam can and cannot do here

Beam's scanner checks skills and MCP configs before you run them using 11 heuristics plus an MCP version-pin check, so a config entry pointing at an unfamiliar remote endpoint is the kind of thing worth scanning for. It is heuristic, not malware analysis, and it cannot see a Windows stealer running outside an agent. Beam's hooks for Claude Code and Codex can flag risky commands and credential exposure in tool calls, fail open without a cached policy, and are not a kernel sandbox. See how Beam works.

Related reading

• Fake Claude Code installers targeting developers
• The AI API key theft supply chain
• The RubyGems attack: how OpenAI agents abused a package build system
• AI agent guardrails: monitoring vs. blocking

Frequently asked questions

Which packages are involved?

Elastic analyzed @apexacc/cli and @apexacc/audit, published by an npm user named apexaccelerator. Both packages and their GitHub repositories are no longer accessible. SafeDep reported three related packages in July (@apexfdn/apex, @copilot-mcp/apex, @apexfdn/copilot-mcp) that distributed a macOS stealer.

How does it hijack AI agent traffic?

The CLI overwrites OPENROUTER_BASE_URL in its process to point at attacker infrastructure and writes an apex-copilot entry into ~/.apex/agent/mcp.json. The attacker then receives prompts and tool outputs and can add instructions to the agent prompt.

Does it install silently on npm install?

Elastic does not describe install-time hooks. The bin launchers run when you invoke the command or use npx, then download platform payloads from GitHub releases.

How do I check if I ran it?

Look for apex-copilot or apex-audit entries in ~/.apex/agent/mcp.json and in Claude Desktop, Cursor and Windsurf MCP settings, OPENROUTER_BASE_URL values pointing at apexaccs.org, and files such as %TEMP%_apex_run.ps1 or the .apex-audit directory.

Who is behind it?

Unclear. Elastic noted Russian-language comments in commit history but said this alone does not establish identity or origin.

Details reflect Elastic's report as of October 19, 2026 and may change.