Threat Actors Pose as Web3 Accelerator to Distribute Malicious npm Packages
Attackers used fake AI credits and audits to trick crypto founders into installing malware that steals data and monitors AI tool usage.
Key points
- The campaign impersonated a venture-capital firm to offer free AI coding credits and security audits to cryptocurrency startups.
- Malicious npm packages installed backdoors on macOS and information stealers on Windows, while hijacking AI model traffic.
- Elastic Security Labs identified the operation, noting that attackers could observe prompts and influence tool outputs via a fake server.
Threat actors are running a sophisticated campaign that impersonates a Web3 venture-capital accelerator to distribute malware through npm packages. The group targets cryptocurrency developers and founders by offering enticing incentives such as free credits for AI coding assistants.
What happened
According to GBHackers, the attackers created a false identity for an accelerator that claimed to support over 200 portfolio projects. The fake entity stated it had raised more than $124 million to fund these initiatives. This fabricated financial background was designed to build trust with potential victims in the cryptocurrency sector.
The operation, branded as Apex Arena and Apex, used a polished public presence to appear credible. Elastic Security Labs noted that the group used fake reviews and investor-style services to enhance its legitimacy. They also sent out event invitations to further the illusion of a legitimate business entity.
Victims were offered free credits for Claude and Gemini, along with AI coding tools. The promise of smart-contract security audits and founder assessments served as additional bait. These offers targeted the specific needs and interests of cryptocurrency startup founders and developers.
Instead of delivering legitimate services, the campaign distributed malicious npm packages. These packages were designed to install platform-specific executables on victim machines. On macOS systems, the malware installed backdoors, while Windows machines received information stealers.
The malicious packages contacted attacker-controlled infrastructure after installation. They executed commands that were selected and sent remotely by the threat actors. This remote control allowed the operators to manage the malware from outside the victim's network.
Elastic found that 1,351 of 1,363 compared files matched the upstream legitimate project. The attackers added a bootstrap component that redirected traffic labeled for OpenRouter models. This redirection sent the data through infrastructure controlled by the Apex operators.
This mechanism gave attackers potential access to sensitive user data. They could view prompts, conversation history, and code snippets submitted through the AI assistant. Tool outputs generated by the AI were also exposed to the threat actors.
The legitimate Oh My Pi project is a real multi-provider coding agent. The attackers used this real project as a cover for their malicious fork. This made the malware harder to distinguish from legitimate software at first glance.
The modified client persistently registered an attacker-controlled Model Context Protocol server. MCP servers can expose tools and instructions to AI clients. In this case, the remote server could provide attacker-controlled tool descriptions and prompt instructions.
Elastic warned that this mechanism expanded the campaign’s control surface. The actors could observe LLM requests and potentially influence subsequent tool use. This allowed for deeper intrusion into the development workflow of the victims.
A test of the service’s investment scoring capability exposed additional deception. Elastic submitted a fictitious project with no repository, team data, or market information. The service still returned an “Apex Score” of 51/100 across five categories.
The system acknowledged that its AI scoring system was unavailable during the test. Investigators assessed the uniform score as a likely fabricated placeholder result. This inconsistency revealed the fraudulent nature of the scoring service.
The separate @apexacc/audit package claimed to provide 18 Web3 security-testing functions. These included smart-contract auditing, honeypot analysis, and token-risk evaluation. The promise of comprehensive security testing was a key lure for developers.
Why it matters
The abuse of a legitimate multi-provider coding agent makes the attack especially effective. Developers may trust the origin of the package due to its real-world counterpart. This trust lowers the barrier to installing the malicious software.
Access to AI prompts and conversation history is a significant security risk. Developers often share sensitive code snippets and architecture details with AI assistants. The attackers gained visibility into this proprietary and potentially sensitive information.
The ability to influence tool outputs via the MCP server is dangerous. Attackers could inject malicious instructions or commands into the development process. This could lead to the creation of compromised code or further security breaches.
The campaign targets a specific and valuable segment of the tech industry. Cryptocurrency startups and their developers hold valuable intellectual property and assets. The high-value nature of these targets makes them attractive for sophisticated attacks.
The use of fake credentials and financial claims adds a layer of social engineering. Victims are more likely to engage with an entity that appears successful and well-funded. This psychological manipulation increases the likelihood of successful compromise.
Our take on the response
- Monitor npm package dependencies for unexpected changes or new versions.
- Verify the legitimacy of venture-capital accelerators and service providers.
- Check for unauthorized network connections or remote command executions.
- Review AI assistant logs for unusual traffic or data exfiltration.
Background: Social engineering
Social engineering is the psychological manipulation of people into performing actions or divulging confidential information. It relies on trust, urgency, and authority to bypass security controls. Defenses require verifying identity through out-of-band channels and validating requests against established procedures.
Read the full guide: Social Engineering Explained: How Manipulation Bypasses Security
What to do and how to stay safe: npm
- Audit your npm dependencies regularly to ensure they come from trusted sources.
- Verify the legitimacy of any accelerator or service offering free credits or audits.
- Monitor your systems for unauthorized outbound connections or remote command executions.
- Review your AI assistant usage logs for any unusual activity or data leaks.
Step-by-step guide: Multi-Factor Authentication Best Practices for Secure Access
General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What type of malware did the attackers distribute?
The attackers distributed malicious npm packages that installed macOS backdoors and Windows information stealers.
How did the attackers gain access to AI assistant data?
They redirected OpenRouter-labelled model traffic through their controlled infrastructure, allowing access to prompts and outputs.
What was the name of the fake accelerator?
The operation was branded as Apex Arena and Apex, according to Elastic Security Labs.
