npm Ecosystem — Malware Campaign and AI Agent Traffic Hijacking via a Fake Web3 Accelerator

Publication date: October 19, 2026
Category: Malware / Artificial Intelligence / Supply Chain Security

Introduction

A sophisticated software supply chain compromise has been uncovered by Elastic Security Labs researchers. Tracked under the threat cluster moniker REF8801, actors distributed malicious packages within the official Node Package Manager (npm) registry while posing as a Web3 venture capital accelerator named Apex Accelerator and the Apex Foundation. Promising free artificial intelligence credits for tools like Anthropic Claude and Google Gemini, alongside coding assistants and smart contract security audits, the fraudulent packages instead delivered custom infostealers and backdoors targeting Windows and macOS workstations, while simultaneously hijacking interactions with AI coding assistants and large language model (LLM) agents.

What is the Threat / Component? (General Analysis)

The primary threat vector leverages the implicit trust developers place in public package registries. By disguising malicious modules as productivity utilities—specifically @apexacc/cli (marketed as an AI advisor for Web3 founders) and @apexacc/audit (a Model Context Protocol server exposing security scanning tools)—the operators successfully targeted cryptocurrency startups and development personnel.

Because this campaign relies on supply chain manipulation rather than a standard software flaw with a dedicated CVE identifier, no official NVD record exists. From an analytical threat modeling perspective, however, the vector is conceptually evaluated as malicious code injection into software dependencies, estimated at a CVSS v3.1 8.8 (High) severity score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), aligning with CWE-506 (Embedded Malicious Code).

How Does It Work? (Technical Analysis)

The threat infrastructure executes distinct infection sequences depending on the victim’s operating system, determined by communicating with an external validation endpoint (vrf.apexaccs[.]org/api/v1/vrf).

  • Windows Infection Chain:

    • The npm package retrieves a Base64-encoded PowerShell command that downloads an initialization script (drop.ps1) from an external server (0auth-chromium[.]com).
    • The script fetches and executes a PyInstaller-packaged binary (bludness.exe) within a hidden window.
    • The loader checks for administrative privileges; if present, it downloads and executes an updated payload (%TEMP%\exegis.exe). If absent, it attempts User Account Control (UAC) bypass via UACME’s ucmDebugObjectMethod().
    • A subsequent Golang executable patches the Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), unhooks ntdll.dll to blind EDR solutions, and injects native shellcode directly into memory.
    • The native infostealer harvests browser credentials (bypassing Chrome’s App-Bound Encryption protections), cryptographic wallet data, clipboard content, system metadata, Wi-Fi profiles, and files, exfiltrating the harvested data via Telegram.

  • macOS Infection Chain:

    • The package initiates a remotely hosted shell script that downloads a GZIP archive from verify.apexfdn[.]xyz/unix/.
    • It deploys a dropper that prompts the user for system login credentials using a fake authorization dialog.
    • Leveraging sudo privileges, the payload performs host discovery, collects hardware details, and contacts an external command-and-control server (ccmihr[.]com) to transmit telemetry and download subsequent tasks.
    • This activity aligns with the distribution mechanisms of the CloudSyncD macOS backdoor.

  • AI Agent and LLM Traffic Hijacking:

    • In addition to platform-specific malware, the packages register a malicious Model Context Protocol (MCP) server within the victim’s agent configuration.
    • This grants the attacker visibility into submitted prompts, conversation histories, code snippets, and tool outputs routed through OpenRouter, while allowing unauthorized instructions to influence the agent’s behavior.

Affected Systems / Environments

  • Operating Systems: Microsoft Windows (64-bit) and Apple macOS.
  • Development Environments: Node.js projects utilizing the npm package manager that integrated dependencies from the compromised namespaces.
  • Specific Compromised Packages:
    • @apexacc/cli (Apex Copilot CLI)
    • @apexacc/audit (Web3 Security Scanner / MCP Server)
    • Prior historical packages linked to the same operation: @apexfdn/apex, @copilot-mcp/apex, @apexfdn/copilot-mcp.

Mitigation and Detection

Remediation

  • Immediate Credential Revocation: Development environments that installed the affected packages must treat all associated API keys, private keys, crypto wallet seeds, and repository tokens as fully compromised and revoke/rotate them immediately.
  • Dependency Auditing: Perform software composition analysis (SCA) and registry integrity checks across active development pipelines.
  • Endpoint Isolation: Isolate and forensic image any workstation where binaries associated with apexaccs[.]org or apexfdn[.]xyz were executed.

Detection

  • Monitor network telemetry for outbound connections to known infrastructure domains (vrf.apexaccs[.]org, 0auth-chromium[.]com, ehegisnightmare[.]icu, verify.apexfdn[.]xyz).
  • Inspect local AI assistant configurations and Model Context Protocol (MCP) server settings for unauthorized integrations.

Defensive Intelligence Note: The simulation of legitimate venture capital backing and conference appearances highlights an evolving social engineering trend targeting technical professionals who routinely evaluate productivity and development tools.

Wrapping Up

The REF8801 campaign underscores the persistent threat of malicious package injection within public software supply chains. By combining cross-platform malware (Windows infostealers and the CloudSyncD macOS backdoor) with novel techniques to compromise AI agent workflows and MCP servers, threat actors demonstrate an expansion into operational environments where intellectual property, source code, and AI model interactions are directly vulnerable.

References