Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

Summary

A fake Web3 accelerator, the Apex Accelerator, distributed malicious npm packages including @apexacc/cli and @apexacc/audit to Windows and macOS users under the pretext of offering free AI credits and security tools. Once installed, the packages deliver an information stealer and backdoors, including a macOS backdoor called CloudSyncD, and exfiltrate data through Telegram, while the promised functionality is fabricated. The operation is tracked as REF8801 and targets cryptocurrency startups and founders.

Topics

• AI agents

Related items

• InfoAI firm Anthropic to commit 5% of shares to fund for ‘public good’Same vendor · The Guardian Technology
• InfoAI researchers stranded Claude on a virtual desert island. It started to “play.”Same vendor · MIT Technology Review
• InfoAnthropic Acquires Confidential AI Startup Opaque SystemsSame vendor · SecurityWeek
• MediumOpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API KeysSame vendor · The Hacker News
• InfoAnthropic says it will commit 5% of its shares to 'public benefit fund'Same vendor · BBC Technology