Threat reportMalwareTL-2026-3389
Apex Arena (REF8801) fake Web3 accelerator spreads CloudSyncD macOS backdoor and multi-stage Windows stealer via malicious npm packages @apexacc/cli and @apexacc/audit
Apex Arena (REF8801) fake Web3 accelerator spreads (TL-2026-3389), also tracked as REF8801, is a high-severity malware campaign, first published 2026-10-13. It has no confirmed attribution, affects npm @apexacc/cli (repackaged Oh My Pi), maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1055), and is covered by 9 detection rules and 35 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 35Indicators of compromise
Key facts for TL-2026-3389
- Threat ID
- TL-2026-3389
- Also known as
- REF8801, Apex Accelerator, Apex Arena, Apex Copilot
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, web3, software development, financial technology, start-ups
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in Apex Arena (REF8801) fake Web3 accelerator spreads
Malware and tooling: CloudSyncD, UACMe
How Apex Arena (REF8801) fake Web3 accelerator spreads works
A fake Web3 venture accelerator (Apex / Apex Arena, tracked by Elastic as REF8801) lures crypto founders and developers with free Claude and Gemini credits, AI coding tools and smart-contract audits, delivering malicious npm packages @apexacc/cli and @apexacc/audit. The packages fetch the CloudSyncD backdoor on macOS and a five-stage Telegram-exfiltrating infostealer on Windows, and reroute AI coding agent LLM traffic through attacker infrastructure.
Elastic Security Labs (published 2026-10-12) tracks the campaign as REF8801. The operators built a fake accelerator brand, Apex, with a private workspace called Apex Arena, claiming 200+ portfolio projects and over $124 million raised, and reinforced credibility with sponsored events, fabricated reviews and conference presence (TOKEN2049). Targets are cryptocurrency start-ups, developers and founders, who are offered free Claude and Gemini credits, an AI coding assistant and security audits.
Two npm packages were malicious from their first release (they were not hijacked): @apexacc/cli, a repackaged copy of the legitimate open-source coding agent Oh My Pi presented as 'Apex Copilot' (GitHub apexaccs/copilot), and @apexacc/audit, a fake MCP-based Web3 security-audit server (GitHub apexaccs/audit-mcp). All 18 audit tool handlers return hard-coded, input-formatted, date-derived or randomized reports instead of running real scans, including false Slither claims and a fixed 68/100 composite score. The packages download platform-specific executables from GitHub releases (apex-windows-x64.exe, apex-audit-windows-x64.exe, apex-darwin-arm64, apex-verify-darwin and audit equivalents). A 'verification' step contacts vrf.apexaccs.org, which returns shell commands for the host to execute.
On macOS, a Rust helper fetches shell commands from the attacker server, shows a fake password prompt that is validated against the system, displays a fake 'shared library version mismatch' error, and executes the CloudSyncD payload with administrator privileges. CloudSyncD is a two-stage macOS backdoor previously documented by Jamf Threat Labs (blog dated 2026-09-30, first sample seen 2026-09-15 in a fake Zoom installer): it phishes the admin password, validates it with dscl, hides it in a decoy ~/.config/zoom/data.json using base64 with random padding and zero-width Unicode markers (U+200B/U+200C), embeds a 756 KB universal Mach-O implant, attempts fileless execution via /dev/fd and falls back to a temp file with sudo, beacons every 8-16 seconds, accepts arbitrary TLS certificates, runs raw Mach-O tasks and unpacks gzipped tar archives with /usr/bin/tar. Jamf observed C2 URI paths masquerading as jQuery scripts and identical encryption keys/IVs across builds; no persistence was observed in Jamf's samples. In the Apex campaign, CloudSyncD C2 is ccmihr.com.
On Windows, the chain uses PowerShell and VBScript bootstrap loaders (%TEMP%\_apex_run.ps1/.vbs, %TEMP%\_audit_run.ps1/.vbs) in five stages: (1) a PowerShell script fetches a Python loader; (2) a known UAC bypass is attempted (a reimplementation of UACME ucmDebugObjectMethod via the AppInfo service RPC); (3) the Python stage runs anti-VM checks against 15 blocklist resources (processes, MAC addresses, manufacturer info, public IP data); (4) a Go loader restores a clean ntdll.dll and patches AMSI and ETW; (5) the stealer runs in memory. On Windows 11 it requests admin rights to exclude a folder from Microsoft Defender and attempts to disable Smart App Control. The stealer collects passwords, cookies, wallets, messenger data, VPN configs, clipboard contents, screenshots, local files and configuration files for Claude, Cursor and Windsurf, organizes them into folders, compresses them and sends them to Telegram bots (tokens XOR-encoded with 0xAA). An infection marker is written to %APPDATA%\.cobra. Elastic noted a packaging error that stopped the initial Windows loader during testing.
AI agent hijacking: the Oh My Pi repackage overwrites OPENROUTER_API_KEY and OPENROUTER_BASE_URL so model requests go to arena.apexaccs.org/api/llm/v1/chat/completions, capturing prompts, code, file contents and conversation history; it registers an attacker-controlled MCP server (8 malicious tools) in ~/.apex/agent/mcp.json for prompt injection, and defaults tool approvals to 'yolo' mode.
Attribution: no confirmed attribution. Russian-language commit comments were noted but are insufficient to determine nationality; download domains were rotated multiple times. The motivation is assessed as financial (cryptocurrency and credential theft), based on the targeting and stealer capabilities.
MITRE ATT&CK techniques used in TL-2026-3389
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1497.001 System Checks; T1620 Reflective Code Loading
Credential Access
T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1059.005 Visual Basic; T1059.006 Python; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Privilege Escalation
T1134.001 Token Impersonation/Theft; T1548.002 Bypass User Account Control; T1548.003 Sudo and Sudo Caching
Initial Access
T1195.002 Compromise Software Supply Chain
defense-impairment
T1553.001 Gatekeeper Bypass; T1685 Disable or Modify Tools
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in Apex Arena (REF8801) fake Web3 accelerator spreads
- npm — @apexacc/cli (repackaged Oh My Pi)
Vulnerable versions: all published versions - npm — @apexacc/audit (fake MCP audit server)
Vulnerable versions: all published versions - Apple — macOS (arm64 and universal Mach-O)
Vulnerable versions: hosts that ran the packages - Microsoft — Windows x64 (including Windows 11)
Vulnerable versions: hosts that ran the packages
Remediation for Apex Arena (REF8801) fake Web3 accelerator spreads
Patches
- No vendor patch; this is malicious software, not a vulnerability. Remove the packages and rebuild affected hosts if executed
Immediate actions
- Remove @apexacc/cli and @apexacc/audit from developer machines, lockfiles, CI caches and internal registries; block the packages in npm proxies
- Block the REF8801 domains at DNS/proxy, including vrf.apexaccs.org, arena.apexaccs.org and ccmihr.com
- Hunt for %APPDATA%\.cobra, %TEMP%\_apex_run.ps1/.vbs, ~/.apex/agent/mcp.json and ~/.local/share/cloudsync/
- Rotate all credentials, API keys, session cookies and wallet secrets on any host that ran the packages; move crypto assets from exposed wallets
- Review OPENROUTER_BASE_URL / OPENROUTER_API_KEY and MCP configuration on developer hosts for tampering
Workarounds
- Block outbound traffic to api.telegram.org from developer workstations where not required
- Do not enter administrator passwords into prompts spawned by npm packages or installers
Longer-term hardening
- Vet third-party npm packages and AI coding agents before use; pin versions and require provenance checks
- Alert on package install scripts that download executables from GitHub releases
- Restrict unattended tool approvals in AI coding agents and allowlist MCP servers
- Deploy EDR with AMSI/ETW tamper and ntdll unhooking detections on Windows, and Gatekeeper/sudo prompt abuse detections on macOS
Timeline of Apex Arena (REF8801) fake Web3 accelerator spreads
- Jamf Threat Labs first encounters CloudSyncD in a development build inside a fake Zoom installer while monitoring VirusTotal
- Two days after first sighting, Jamf identifies CloudSyncD samples configured against live C2 domains, indicating a move from testing to deployment
- Jamf publishes its analysis of the two-stage CloudSyncD macOS backdoor
- SC Media reports on the CloudSyncD macOS backdoor delivered through a fake Zoom installer, following the Jamf publication
- Around Elastic's publication, TOKEN2049 organizers were notified of the fake accelerator's conference presence and its Luma event listing was subsequently taken down for terms-of-service violations
- Elastic Security Labs publishes its REF8801 report on the fake Apex accelerator and the malicious @apexacc/cli and @apexacc/audit npm packages
- GBHackers, SecurityOnline and Cyberpress report the campaign, which targets crypto start-ups with Claude and Gemini credit lures; the campaign remains active
Sources cited for Apex Arena (REF8801) fake Web3 accelerator spreads
- Elastic Security Labs: Apex Accelerator malicious npm packages (REF8801)
- Fake Web3 Accelerator Offers Claude and Gemini Credits to Spread Malware (GBHackers)
- Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents (SecurityOnline)
- Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders (Cyberpress)
- Auditing the auditor: Unmasking Apex Accelerator (daily.dev summary of Elastic report)
- Jamf Threat Labs: CloudSyncD, a two-stage macOS backdoor that hides a phished password in zero-width Unicode
- SC Media: Fake Zoom installer delivers new CloudSyncD macOS backdoor
Detection coverage for TL-2026-3389
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3389 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.