{"data":{"id":"ed94b043-212f-4e35-91ef-edb475b7f3ca","title":"Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic","summary":"A fake Web3 accelerator, the Apex Accelerator, distributed malicious npm packages including @apexacc/cli and @apexacc/audit to Windows and macOS users under the pretext of offering free AI credits and security tools. Once installed, the packages deliver an information stealer and backdoors, including a macOS backdoor called CloudSyncD, and exfiltrate data through Telegram, while the promised functionality is fabricated. The operation is tracked as REF8801 and targets cryptocurrency startups and founders.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/10/fake-web3-accelerator-uses-npm-packages.html","publishedAt":"2026-10-19T10:06:40.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic","Google"],"affectedVendorsRaw":["Anthropic Claude","Google Gemini","Claude Fable 5","Gemini 2.5 Flash","Model Context Protocol (MCP)","npm packages @apexacc/cli and @apexacc/audit"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-19T10:06:40.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}