Fake Web3 Accelerator Spread Malware Through npm Packages

A fake investment accelerator offered cryptocurrency startups free AI credits, coding tools and security audits, but its npm packages installed malware on Windows and Mac computers. Anyone who ran the packages should treat that computer and the accounts used on it as potentially compromised.

What happened

The operation presented itself as Apex Accelerator, a venture capital program for Web3 founders. According to The Hacker News, its operators approached cryptocurrency developers with investment offers and directed them to install tools published as @apexacc/cli and @apexacc/audit.

The packages did not provide the promised services. The audit package produced made-up security findings, while the command-line package returned an unsupported assessment of a fictitious project. Both downloaded additional programs from GitHub releases after checking whether the computer used Windows or macOS.

On Macs, the campaign installed a backdoor called CloudSyncD. On Windows, it deployed a custom information stealer that sent data through Telegram, according to the report. The packages could also intercept and redirect OpenRouter AI model traffic through services controlled by the attackers.

The npm packages and their related GitHub repositories are no longer available. The source did not disclose how many computers were infected, who operated the campaign or whether every installation successfully delivered malware.

Who is affected

The clearest risk is to cryptocurrency founders, developers and small teams that installed either Apex package. Both Windows and macOS systems were targeted.

People who only visited the accelerator’s website or met its representatives are not identified as infected in the report. The danger came from installing and running the offered npm tools. Appearing at industry events helped the group look legitimate, so an in-person introduction should not be treated as proof that software is safe.

What to do now

1. Check whether the packages were used. Search project folders, package.json, package-lock.json and terminal history for @apexacc/cli or @apexacc/audit. Ask every developer or contractor with access to the project to check their computer.

2. Disconnect a suspected computer from the network. Turn off Wi-Fi or unplug Ethernet before signing in to more accounts. Stop running the affected project until the computer has been examined and cleaned.

3. Remove the packages and scan the entire computer. Delete the Apex packages from the affected project, then run a full scan with a trusted security tool. On Windows, open Windows Security > Virus & threat protection > Scan options > Full scan. Mac users should use a reputable malware scanner because the reported Mac payload was a backdoor.

4. Change important credentials from a different, clean device. Start with primary email, GitHub, npm, cryptocurrency exchanges, wallets with online credentials, and AI services used on the affected computer. Revoke active sessions and replace exposed API keys or access tokens where those services provide that option.

5. Review account and cryptocurrency activity. Look for unfamiliar logins, new access tokens, changed recovery details or transactions you did not approve. Contact the relevant provider immediately if anything is wrong.

6. Verify future investment tools independently. Before installing software supplied by an accelerator or investor, confirm the package publisher, inspect the linked repository and test unfamiliar code only in an isolated environment without real credentials.