Affected Systems

npm packages @apexacc/cli and @apexacc/audit (now removed); targets Windows and macOS developer systems. Campaign linked to Apex Accelerator/Apex Foundation (apexaccs[.]org, apexfdn[.]xyz). Delivers CloudSyncD macOS backdoor and custom Windows information stealer. Also affects earlier packages @apexfdn/apex, @copilot-mcp/apex, @apexfdn/copilot-mcp distributing Atomic Stealer (AMOS).

Exploitation Status

Active exploitation confirmed since at least April 2026. Threat actor REF8801 actively approaching cryptocurrency wallet developers and Web3 startups via social media (X) with investment offers. Malicious packages removed from npm but campaign ongoing with social engineering component.

Business Impact

Developers in cryptocurrency and Web3 sectors face credential theft, session hijacking, and persistent backdoor access. Windows stealer exfiltrates browser passwords (bypassing Chrome app-bound encryption), cookies, clipboard data, Wi-Fi profiles, wallet data, VPN credentials, and FTP credentials via Telegram. macOS backdoor (CloudSyncD) provides persistent access. Fake audit tools generate fabricated security findings, potentially misleading security assessments. AI agent traffic hijacking redirects model requests through attacker infrastructure.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all npm package installations for @apexacc/cli, @apexacc/audit, @apexfdn/apex, @copilot-mcp/apex, and @apexfdn/copilot-mcp; uninstall immediately if present and treat affected systems as compromised.
  • Hunt for indicators: domains vrf.apexaccs[.]org, 0auth-chromium[.]com, ehegisnightmare[.]icu; macOS process com.apple.system.loader and CloudSyncD; Windows processes bludness.exe, exegis.exe, updater_loader.exe in %TEMP%.
  • Block outbound connections to apexaccs[.]org, apexfdn[.]xyz, vrf.apexaccs[.]org, 0auth-chromium[.]com, and ehegisnightmare[.]icu at perimeter and DNS layers.
  • Rotate all credentials, API keys, and session tokens on systems where suspicious npm packages were installed; prioritize cryptocurrency wallets, cloud service accounts, and VPN credentials.
  • Educate development teams on supply chain risks; implement npm package vetting process and restrict installation to verified publishers; warn against unsolicited investment offers requiring CLI tool installation.

---

# Threat Actor Context

Actor Profile

REF8801 is a threat actor operating a fake Web3 venture capital accelerator named Apex Accelerator (also linked to Apex Foundation) to target cryptocurrency startups, Web3 founders, and developers in the software development and AI sectors. The actor poses as a legitimate investment firm offering $235,000 investments, grants, partnerships, and free AI credits for Anthropic Claude and Google Gemini. Russian-language comments have been observed in source code commit history, though attribution remains uncertain. The operation has been active since at least March 2026, with artifacts dating back to April 2026. The actor attempts to manufacture legitimacy through presence at conferences like TOKEN2049 in Singapore and hosting in-person events, while directly approaching cryptocurrency wallet developers and market intelligence tool creators with investment offers.

TTPs (Tactics, Techniques, Procedures)

REF8801 leverages supply chain compromise through malicious npm packages (@apexacc/cli, @apexacc/audit, @apexfdn/apex, @copilot-mcp/apex, @apexfdn/copilot-mcp) that masquerade as legitimate developer tools. The Windows infection chain employs T1059.001 (PowerShell execution) with Base64-encoded commands, T1548.002 (UAC bypass via UACME's ucmDebugObjectMethod), T1562.001 (AMSI and ETW patching, ntdll.dll unhooking to impair defenses), and T1055 (process injection via shellcode loading). The custom Windows information stealer performs T1082 (system discovery), T1057 (process discovery), T1497 (virtualization/sandbox evasion via anti-VM checks), T1113 (screen capture), T1555 (credential harvesting from browsers, wallets, VPN clients, FTP applications), T1115 (clipboard data theft), and bypasses Chrome's app-bound encryption protections. The macOS payload delivers CloudSyncD backdoor and Atomic Stealer (AMOS) family malware. Data exfiltration occurs via T1041 through Telegram. The operation also repackages legitimate coding agents to redirect AI model requests through attacker-controlled infrastructure for traffic hijacking.

Targets & Patterns

REF8801 specifically targets software developers, Web3/cryptocurrency startups and founders, and organizations in the artificial intelligence sector. The actor focuses on developers of cryptocurrency wallets and market intelligence tools for traders, approaching them with direct investment offers and instructions to install malicious npm packages disguised as due diligence tools, AI advisors, and security audit scanners. The targeting pattern exploits the developer community's trust in npm packages and the appeal of venture capital funding in the Web3 ecosystem. By offering free AI credits for premium services (Claude, Gemini) and security auditing tools, the actor leverages developers' operational needs to achieve initial access. The campaign's focus on both Windows and macOS ensures broad coverage across developer workstations, while the fake security audit tools generating fabricated findings further deceive victims into believing they are receiving legitimate services.

Historical Context

The REF8801 campaign has been active since at least March 2026, with Internet Archive snapshots of the Apex Foundation website dating to March 19, 2026. SafeDep first documented three malicious npm packages linked to this operation in late July 2026 (@apexfdn/apex, @copilot-mcp/apex, @apexfdn/copilot-mcp) distributing Atomic Stealer (AMOS) for macOS. Socket artifacts show the Apex Foundation has been associated with at least two distinct domains since April 2026: apexaccs[.]org and apexfdn[.]xyz. The October 2026 Elastic Security Labs report identified two additional packages (@apexacc/cli, @apexacc/audit) continuing the same operational pattern. This represents an evolving campaign that has maintained consistent infrastructure, social engineering tactics (fake accelerator/investment offers), and technical objectives (information theft, backdoor deployment) over at least a seven-month period, demonstrating sustained operational capability and adaptation to detection efforts.

Defensive Recommendations

  • Monitor npm package installations for suspicious publishers and newly created accounts, particularly those offering free premium services or investment opportunities; scrutinize packages from 'apexaccelerator' and related entities
  • Detect T1059.001 PowerShell execution with Base64-encoded commands via Sysmon Event ID 1 and PowerShell ScriptBlock logging (Event ID 4104); alert on PowerShell downloads from unusual domains like 0auth-chromium[.]com
  • Implement detection for T1548.002 UAC bypass attempts and T1562.001 defense impairment via AMSI/ETW patching and ntdll.dll unhooking through EDR behavioral monitoring and integrity checks on security subsystems
  • Block network communications to known malicious infrastructure: vrf.apexaccs[.]org, 0auth-chromium[.]com, ehegisnightmare[.]icu, apexaccs[.]org, apexfdn[.]xyz; monitor for Telegram-based exfiltration patterns
  • Deploy application control policies to prevent execution of PyInstaller and Golang executables from temporary directories (%TEMP%) and suspicious macOS app bundles (com.apple.system.loader); hunt for CloudSyncD backdoor and AMOS stealer artifacts