Fake Web3 Accelerator Offers Claude and Gemini Credits to Spread Malware

A sophisticated campaign in which threat actors posed as a Web3 venture-capital accelerator to target cryptocurrency start-ups, developers and founders with free Claude and Gemini credits, AI coding tools and smart-contract security audits.

It claimed to support more than 200 portfolio projects and to have raised over $124 million, while promoting founder assessments, security audits, job listings and direct investor-relations messaging.

Behind the façade, however, the group distributed malicious npm packages designed to install macOS backdoors and Windows information stealers.

Elastic identified two packages, @apexacc/cli and @apexacc/audit, which advertised an AI coding assistant and an MCP-based Web3 audit suite.

Rather than providing legitimate services, the packages downloaded platform-specific executables, contacted attacker-controlled infrastructure and executed commands selected remotely.

Elastic found that 1,351 of 1,363 compared files matched the upstream project, while the attackers added a bootstrap component that redirected OpenRouter-labelled model traffic through Apex-controlled infrastructure.

This gave operators potential access to prompts, conversation history, code snippets and tool outputs submitted through the AI assistant.

The legitimate Oh My Pi project is a real multi-provider coding agent, making its abuse especially effective as cover for the malicious fork.

The modified client also persistently registered an attacker-controlled Model Context Protocol server.

MCP servers can expose tools and instructions to AI clients; in this case, the remote server could provide attacker-controlled tool descriptions and prompt instructions.

Elastic warned that the mechanism expanded the campaign’s control surface by allowing the actors to observe LLM requests and potentially influence subsequent tool use.

A test of the service’s purported investment scoring capability exposed additional deception. Elastic submitted a fictitious project with no repository, team data, contract address or market information.

The service still returned an “Apex Score” of 51/100 across five categories while acknowledging that its AI scoring system was unavailable. Investigators assessed the uniform score as a likely fabricated placeholder result.

The separate @apexacc/audit package claimed to provide 18 Web3 security-testing functions, including smart-contract auditing, honeypot analysis and token-risk evaluation.

Elastic Security Labs said that, the operation, branded as Apex Arena and Apex, used a polished public presence, fake reviews, investor-style services and event invitations to appear credible.

Fake Web3 Accelerator

Elastic determined that every published handler returned hard-coded, randomized or date-derived results rather than conducting the advertised scans.

The @apexacc/cli package repackaged Oh My Pi, a legitimate open-source coding agent, to make the tool appear functional.

For example, the audit_full_contract function returned a fixed report claiming Slither had analyzed 847 lines of code, while audit_honeypot always concluded that a token was not a honeypot.

Another tool generated risk scores randomly between 55 and 94, meaning it could only produce “SAFE” or “WARN” verdicts and never a danger classification.

On macOS, the campaign used a Rust-based verifier to contact vrf.apexaccs[.]org, retrieve a server-selected command and download an installer linked to the CloudSyncD malware family.

CloudSyncD requests an administrator password through a fraudulent authorization dialog, collects host information and contacts a command-and-control server for follow-on tasks.

Jamf previously documented CloudSyncD as a two-stage macOS backdoor disguised as a legitimate installer.

It uses a fake password prompt, system reconnaissance and encrypted command-and-control tasking, demonstrating the campaign’s ability to turn a developer-tool lure into persistent device access.

On Windows, the npm packages retrieved PowerShell commands from the same verification endpoint. The execution chain used VBScript and PowerShell staging before delivering a multi-stage stealer.

Later components attempted privilege elevation, anti-virtual-machine checks, ntdll.dll unhooking, AMSI and ETW tampering, and in-memory shellcode execution. The final stealer compressed collected data and exfiltrated it through Telegram.

The campaign illustrates how trust can be manufactured through AI-generated websites, cloned open-source tools, fake customer reviews, conference references and realistic investor branding.

The attackers did not rely on a crude phishing email; they built an ecosystem intended to appeal to high-value Web3 targets that may hold cryptocurrency wallets, signing keys, cloud credentials, source code and API tokens.

Earlier reporting on related Apex infrastructure also documented malicious npm packages using free-LLM-credit lures and repackaged coding tools to deploy macOS credential-stealing malware.

The activity showed that package removal alone may not end the operation, as operators can republish under a new name while retaining the same repositories, binaries and command-and-control infrastructure.

Organizations should block the identified package names and associated domains, review endpoint telemetry for execution from suspicious npm-installed tools, and rotate credentials, API keys, cloud tokens and wallet secrets if the packages were executed.

Developers should avoid installing AI, MCP or security-audit tools solely on the basis of social proof, free model credits or polished project branding, particularly when packages download binaries at runtime or route LLM traffic through third-party endpoints.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.