GajShield Threat Advisory — REF8801 “Apex Accelerator” Malicious npm Packages and Infostealers

Severity: High | Priority: 1

REF8801 is a campaign that operators pose as “Apex,” a Web3 startup accelerator, and target cryptocurrency founders and developers. They build credibility with:

• fake portfolio and funding claims
• fake reviews and blog posts
• event listings and an in-person invitation site
• free Claude and Gemini AI credits

Victims are persuaded to install two npm packages, @apexacc/cli (“Apex Copilot”, a repackaged open-source coding agent) and @apexacc/audit, an MCP server whose 18 “security audit” tools return fabricated results. Both packages download a platform-specific executable that fetches commands from the attackers. On macOS, this installs the CloudSyncD backdoor, which phishes the administrator password through a fake dialog and can run further payloads as root. On Windows, it bypasses UAC, disables security tooling and installs an infostealer that sends data to Telegram. That data includes:

• browser passwords and cookies
• cryptocurrency wallets
• messaging and VPN data
• AI tool configs for Claude, Cursor and Windsurf
• files from user folders

The coding agent also routes the developer’s AI prompts and code through attacker servers. It runs with tool approvals defaulted to “yolo” and registers an attacker-controlled MCP server that can inject instructions.

If an alert is raised, treat the source machine as compromised and isolate it from your network. Then:

1. Identify the developer and check whether @apexacc/cli or @apexacc/audit is installed. Look for these artefacts:
   • On Windows: _apex_run.ps1, _apex_run.vbs, _audit_run.*, exegis.exe or updater_loader.exe in %TEMP%; a %APPDATA%\.cobra file; and a Defender exclusion for %USERPROFILE%\.apex-audit.
   • On macOS: ~/.config/cloudsync/, ~/.local/share/cloudsync/ and a running cloudsync process.
   • On any platform: ~/.apex/agent/mcp.json.
2. Remove the packages and rebuild the machine rather than cleaning it.

Because the infostealer takes browser data and AI tool configs, the user should reset everything stored or used on that machine from a separate, clean device:

• browser-saved passwords and session cookies, signing out of all sessions
• cryptocurrency wallet seed phrases, moving funds to new wallets
• AI service API keys and any Apex token
• source-code hosting tokens such as GitHub and npm
• SSH keys and cloud credentials

Any source code or secrets the developer used while the Apex Copilot agent was running should be treated as exposed to the attackers.

To reduce exposure:

• Check every developer machine on your network for the @apexacc packages.
• Install npm packages only from publishers you have verified, and review packages that download executables at install time.
• Disable “yolo” or auto-approve modes in AI coding agents.
• Verify accelerator, investor and audit offers independently before installing any tools they supply.