REF8801 uses fake Web3 accelerator to distribute cross-platform malware to crypto founders

Elastic Security Labs has identified a sophisticated campaign by the threat actor REF8801, which posed as a Web3 venture capital accelerator to target cryptocurrency start-ups. The group distributed malicious npm packages and backdoored code repositories to founders seeking AI credits and security audits, according to the research published by the lab.

How it unfolded

• Elastic Security Labs detected suspicious behaviour in the npm package @apexacc/cli via a supply-chain monitor bot, identifying it as malicious from publication.
• The lab linked the package to a publisher previously reported by SafeDep, who shortly after published another malicious package, @apexacc/audit.
• Researchers examined the group's websites, packages, and distributed malware, revealing a scheme using AI and Web3 products as a multistage delivery mechanism.

Who is affected

The operation targeted cryptocurrency start-ups and founders through a fake entity called Apex Accelerator. According to Elastic Security Labs, the group offered free AI credits for Claude and Gemini, along with coding tools and security audits. The fake accelerator claimed to have over 200 portfolio projects and more than $124 million in capital, using fake reviews and conference attendance to build credibility.

View the original post on X

The malicious tools delivered information-stealing malware and backdoors for both macOS and Windows machines. The campaign distributed CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrated data through Telegram. Additionally, the group repackaged a legitimate coding agent to route model requests through attacker-controlled services, intercepting large language model traffic.

All 18 tools within the @apexacc/audit package returned fabricated security findings, according to Elastic Security Labs. In separate testing, the remote scoring service for @apexacc/cli returned a score of 51/100 for a fictitious project while claiming its AI scorer was unavailable. The group also advertised in-person events, including at TOKEN2049 in Singapore, to appear legitimate.

The fix

No patch or fix has been confirmed yet for the affected npm packages or the malware distributed by REF8801. Elastic Security Labs notified conference organizers of the activity before publication. The research aims to raise awareness of similar scams that use AI-generated code and websites to create polished, illegitimate operations.

Background: Threat actors

A threat actor is any entity that initiates a cyber attack. They range from automated software to organised criminal groups. Understanding their motive helps you predict their behaviour. Most are not after you specifically but exploit common weaknesses for quick financial gain.

Read the full guide: Threat Actors Explained: Motives, Methods and Misconceptions

What to do and how to stay safe

• Verify the reputation of npm packages and AI tools before installation, checking for suspicious publisher histories or sudden popularity spikes.
• Monitor network traffic for unexpected connections to unknown services, particularly those related to large language model requests or Telegram.

Step-by-step guide: How Common Misconfigurations Trigger Silent Data Leaks

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.