A recently uncovered cyberattack campaign involving a fake Web3 accelerator demonstrates how cybercriminals are combining software supply chain attacks, social engineering and artificial intelligence to compromise developers and cryptocurrency startups.

Researchers at Elastic Security Labs identified an operation tracked as REF8801, in which attackers impersonated a venture-capital accelerator called Apex Accelerator.

The organization offered attractive incentives, including free AI credits, coding assistants, investment opportunities and smart-contract security audits.

However, the npm packages promoted through this platform were malicious.

Two packages, @apexacc/cli and @apexacc/audit, claimed to provide an AI coding assistant and a collection of 18 security auditing tools.

Instead, they delivered malware designed to compromise Windows and macOS systems.

On Windows, the attack deployed a custom information stealer capable of collecting browser credentials, session cookies, cryptocurrency wallet information and other sensitive data.

On macOS, the packages installed the CloudSyncD backdoor, which used a fraudulent authorization prompt to obtain the user's system password and establish privileged access.

But the campaign went beyond conventional malware distribution.

The attackers also repackaged a legitimate open-source AI coding agent, modifying it to redirect AI model requests through infrastructure under their control.

This potentially exposed prompts, conversation history, source code snippets and tool outputs submitted through the compromised agent.

Even more concerning, the modified agent registered an attacker-controlled Model Context Protocol server.

An MCP server can provide tools, descriptions and instructions that influence how an AI agent interacts with external systems.

By controlling this integration, attackers could potentially influence the agent's subsequent behavior, not merely observe its conversations.

This introduces an important new dimension to software supply chain security.

A compromised developer tool can now threaten three distinct security boundaries:

First, the endpoint itself, through malware installation and credential theft.

Second, the confidentiality of information submitted to AI services, including source code and sensitive business data.

Third, the integrity of AI-assisted workflows, where attacker-controlled tools and instructions may influence subsequent actions.

The campaign also highlights how easily apparent credibility can be manufactured.

Professional websites, investment claims, conference associations and seemingly legitimate security tools were used to persuade developers to install untrusted software.

Organizations must therefore evaluate AI coding assistants, npm packages and MCP integrations with the same security discipline applied to other privileged software.

This includes verifying package provenance, restricting execution privileges, reviewing external AI endpoints, monitoring unexpected network connections and controlling which MCP servers are permitted to operate.

Developers should also avoid installing tools solely because they promise free AI credits, investment opportunities or automated security assessments.

The broader lesson is that AI tools are becoming part of the enterprise security boundary.

Protecting them requires more than traditional malware detection.

Organizations must secure the software supply chain, the information flowing through AI systems and the external tools that AI agents are authorized to invoke.

An AI assistant should never become an invisible channel through which attackers can observe sensitive information or influence trusted development workflows.

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic

Source: Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic via The Hacker News — published 19 Oct 2026.