Fake Web3 accelerator uses npm packages to steal data and hijack AI agent traffic

The Hacker News reported on October 19, 2026 on research from Elastic Security Labs into a campaign it tracks as REF8801. The group poses as a Web3 venture accelerator called Apex Accelerator and targets crypto startups and founders with offers of investment, free Claude and Gemini credits, coding tools and security audits. Targets were told to run two npm packages: @apexacc/cli, pitched as an AI advisor for founders, and @apexacc/audit, billed as an MCP server with 18 security tools.

Neither package does what it claims. The audit tools invent findings, while the real job is to install malware: a custom Windows information stealer that sends data out through Telegram, and a macOS backdoor called CloudSyncD that tricks victims into typing their system password into a fake prompt. The Windows chain tries to blind security tools and can pull saved passwords and cookies from Chrome despite its app-bound encryption.

The packages also go after AI coding setups. They can redirect OpenRouter model traffic and register an attacker-run MCP server in the victim's agent configuration. Elastic says this lets the attackers see prompts, chat history, code and tool output, and even feed instructions to the agent. Both packages and their GitHub repositories are no longer available.

Why it matters

Developers' AI agents are now a target in their own right, so unknown MCP servers and model proxies deserve the same suspicion as unknown binaries.

Source: The Hacker News