- Elastic Security Labs found a fake Web3 accelerator that used npm packages, a repackaged AI coding agent and fake security audits to infect founders' machines.
- The AI agent sent prompts, code and file contents to an attacker-run server, and the audit tool's 18 checks returned fabricated results.
- Teams should check where their AI tools send traffic, vet npm publishers, and treat free AI credits from unknown groups as untrusted.
The tool that checks your work can be the threat
Most people picture an attack as something that breaks in. The operation Elastic Security Labs calls REF8801 was invited in. It posed as a Web3 venture accelerator. It offered crypto start-ups free AI credits, coding tools and security audits.
The lesson here is that polish is now cheap. Elastic notes that AI-generated code, websites and portfolios make shady operations look established. A founder who cannot tell a real accelerator from a fake one has lost the oldest check there is. That check is simple: does this look like a serious business?
What Elastic found
Elastic's supply-chain monitor flagged an npm package called @apexacc/cli. npm is the public library where developers fetch code. This package was malicious from the day it was published. It was not a trusted package that got hijacked.
The package led researchers to "Apex Arena." The site presents itself as a private workspace for crypto founders. It claims more than 200 portfolio projects and over $124 million raised. Those are the site's own claims, not verified figures.
The group also used fake reviews and an event invitation page. It had a presence at TOKEN2049 in Singapore. Elastic told the conference organizers before publishing.
The packages were a delivery route for malware on both Mac and Windows computers. Elastic describes data-stealing programs and backdoors, which give an attacker remote access. One Mac payload is CloudSyncD, which Jamf has also discussed. The Windows stealer sends data out through Telegram.
How the trap works
The package's launcher downloads a program from the group's GitHub releases and starts it. Inside is a genuine open-source coding agent called Oh My Pi. Elastic compared Apex Copilot v1.6.1 with Oh My Pi v16.3.6. It looked at files under the coding-agent source folder. Of 1,363 files there, 1,351 matched exactly. The working agent gives the victim no reason for suspicion.
The small addition does two jobs. First, it contacts a server the attacker controls and runs the command that comes back. On Windows, that is a PowerShell script launched through a VBScript helper. On macOS, it fetches a script that installs a dropper. A dropper is a first-stage program that brings in more malware.
Second, it reroutes the agent's AI traffic once the user has an Apex token. The tool still labels its provider "OpenRouter." The requests actually go to the attacker's server. That server sees prompts, conversation history, code snippets and the output of local tools.
The addition also registers an attacker-run tool server. That server can add its own instructions to the agent's prompt.
Elastic tested the leak. It created a file with a unique value and asked the agent to read it. The next request to the attacker's endpoint carried the file's contents.
The copied agent's default setting approves read, write and execute actions automatically. Elastic says a hostile server could use that to drive local tools. Elastic did not see the attacker swap in malicious responses.
An audit that audits nothing
The second package, @apexacc/audit, advertises 18 security tools. Elastic read the code behind all of them. None runs a real scan. Each prints a canned, date-based or random report.
The Windows code also tries to exclude its own folder from Microsoft Defender scanning. It tries to switch off Smart App Control too.
The scoring service was no better. Elastic described an invented project and gave no repository, contract or team details. The service still produced a grade of 51 out of 100. It did so while saying its AI scorer was unavailable.
Think of a fake building inspector who arrives with a clipboard and a badge. The report he writes is worthless. The visit itself is the damage.
What leaders should ask
First, ask where your developers' AI tools send their traffic. Any change to a model endpoint or tool-server setting is a data-flow change. Look in configuration files for entries nobody can explain.
Second, ask who approves new npm packages and AI agents. A package run through npx executes code on the machine of whoever launches it. Check the publisher before the first run.
Third, treat free AI credits and free audits from unknown groups as untrusted. Verify any auditor through channels the auditor does not control.
Fourth, review agent permissions. Require confirmation for anything beyond reading.
The deepest risk here is not the malware. It is that one attacker supplied the answers, the audit and the AI model all at once.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Elastic Security Labs.
