(elastic.co) Unmasking Apex Accelerator: A Sophisticated Web3 Scam Leveraging Malicious npm Packages and AI Infrastructure
In brief - This article details a sophisticated scam by a fake Web3 venture capital accelerator called Apex Accelerator, which targets cryptocurrency founders to deploy cross-platform information-stealing malware. The operation uses a combination of polished AI-driven services, malicious npm packages, and deceptive security audits to gain trust and compromise victim machines.
Technically - This article describes a multi-stage infection chain utilizing malicious npm packages (@apexacc/cli and @apexacc/audit) that deploy platform-specific Bun executables. On macOS, the chain uses a Rust-based verifier to download the CloudSyncD backdoor, which employs custom XOR-based string obfuscation and requests sudo privileges via a fake authorization dialog. On Windows, the attack leverages a complex sequence involving PowerShell, VBScript, and PyInstaller-packaged Python loaders that implement a UAC bypass via RPC requests to the AppInfo service. The final Windows payload is a Golang loader that performs ntdll.dll unhooking and AMSI/ETW patching before executing a native infostealer. This stealer uses a unique block-shuffle protection mechanism restored via a deterministic 64-bit number generator and targets sensitive data including AI client configurations (Claude, Cursor, Windsurf) and Chrome App-Bound encrypted keys, exfiltrating the stolen data via Telegram bots.
Source: https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages