REF8801 targets crypto founders with malicious npm packages via fake Apex Accelerator

Elastic Security Labs identified a malicious npm package named @apexacc/cli, which served as an entry point into a broader operation posing as a Web3 accelerator. This group, tracked as REF8801, spent months building a public presence to target cryptocurrency startups and founders. They offered free AI credits, coding tools, and security audits to lure victims into their ecosystem.

How did the fake accelerator attract victims?

The operation presented itself as Apex Arena, a private workspace for crypto founders backed by an accelerator called Apex. The website claimed to have over 200 portfolio projects and more than $124 million in raised capital. To build credibility, the group advertised an in-person event through a dedicated invitation page and attended TOKEN2049 in Singapore. They also used fake reviews and fabricated security findings from their own audit tools to appear legitimate.

View the original post on X

What malicious components were delivered?

The tools delivered information-stealing malware and backdoors for both macOS and Windows machines. Specifically, the campaign distributed CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrates data through Telegram. The operation also repackaged a legitimate coding agent to send model requests through attacker-controlled services. All 18 tools in the @apexacc/audit package returned fabricated security findings, while the remote scoring service reported false scores for fictitious projects.

How was the campaign discovered?

Elastic Security Labs uncovered the scheme after a Slack notification from a supply-chain monitor bot flagged suspicious behavior tied to the npm package @apexacc/cli. Upon inspection, researchers determined the package was malicious from the moment it was published, rather than being a supply chain compromise. Later that day, they linked the package to the same publisher behind a campaign previously reported by SafeDep. The threat actor subsequently published another malicious package, @apexacc/audit, as part of the same effort.

What is the current status of the threat?

The research highlights how AI-generated code, websites, and portfolios can make illegitimate operations look polished and well-established. The group uses these AI and Web3 products as the presentation for a multistage delivery mechanism. Elastic Security Labs notified conference organizers of the activity before publication. No fix has been confirmed yet for the compromised packages, though the malicious nature of @apexacc/cli and @apexacc/audit is now documented.

What to do and how to stay safe: REF8801

• Audit installed npm packages for unknown or unverified publishers, especially those offering free AI credits or audit services.
• Monitor network traffic for unexpected connections to Telegram or unknown endpoints that may indicate data exfiltration.
• Verify the legitimacy of Web3 accelerators and investment groups through independent sources before engaging with their tools.
• Review system logs for signs of backdoors or information stealers on both macOS and Windows machines used for development.

Step-by-step guide: Data Breach Response Plans: Real Value vs Operational Limits

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which npm packages are confirmed to be malicious in this campaign?

The packages @apexacc/cli and @apexacc/audit are confirmed to be malicious, containing backdoors and fabricated audit tools.

What types of malware were distributed by REF8801?

The group distributed CloudSyncD malware for macOS and a custom Windows information stealer that sends data via Telegram.

How did the attackers make their operation appear legitimate?

They created a fake website claiming significant capital and portfolio projects, used fake reviews, and attended industry conferences like TOKEN2049.