# Apex Arena (REF8801) fake Web3 accelerator spreads CloudSyncD macOS backdoor and multi-stage Windows stealer via malicious npm packages @apexacc/cli and @apexacc/audit

> A fake Web3 venture accelerator (Apex / Apex Arena, tracked by Elastic as REF8801) lures crypto founders and developers with free Claude and Gemini credits, AI coding tools and smart-contract audits, delivering malicious npm packages @apexacc/cli and @apexacc/audit. The packages fetch the CloudSyncD backdoor on macOS and a five-stage Telegram-exfiltrating infostealer on Windows, and reroute AI coding agent LLM traffic through attacker infrastructure.

- **Published:** 2026-10-13T09:21:15Z
- **Last reviewed:** 2026-10-13T09:21:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3389
- **ID:** TL-2026-3389
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Elastic Security Labs (published 2026-10-12) tracks the campaign as REF8801. The operators built a fake accelerator brand, Apex, with a private workspace called Apex Arena, claiming 200+ portfolio projects and over $124 million raised, and reinforced credibility with sponsored events, fabricated reviews and conference presence (TOKEN2049). Targets are cryptocurrency start-ups, developers and founders, who are offered free Claude and Gemini credits, an AI coding assistant and security audits.

Two npm packages were malicious from their first release (they were not hijacked): @apexacc/cli, a repackaged copy of the legitimate open-source coding agent Oh My Pi presented as 'Apex Copilot' (GitHub apexaccs/copilot), and @apexacc/audit, a fake MCP-based Web3 security-audit server (GitHub apexaccs/audit-mcp). All 18 audit tool handlers return hard-coded, input-formatted, date-derived or randomized reports instead of running real scans, including false Slither claims and a fixed 68/100 composite score. The packages download platform-specific executables from GitHub releases (apex-windows-x64.exe, apex-audit-windows-x64.exe, apex-darwin-arm64, apex-verify-darwin and audit equivalents). A 'verification' step contacts vrf.apexaccs.org, which returns shell commands for the host to execute.

On macOS, a Rust helper fetches shell commands from the attacker server, shows a fake password prompt that is validated against the system, displays a fake 'shared library version mismatch' error, and executes the CloudSyncD payload with administrator privileges. CloudSyncD is a two-stage macOS backdoor previously documented by Jamf Threat Labs (blog dated 2026-09-30, first sample seen 2026-09-15 in a fake Zoom installer): it phishes the admin password, validates it with dscl, hides it in a decoy ~/.config/zoom/data.json using base64 with random padding and zero-width Unicode markers (U+200B/U+200C), embeds a 756 KB universal Mach-O implant, attempts fileless execution via /dev/fd and falls back to a temp file with sudo, beacons every 8-16 seconds, accepts arbitrary TLS certificates, runs raw Mach-O tasks and unpacks gzipped tar archives with /usr/bin/tar. Jamf observed C2 URI paths masquerading as jQuery scripts and identical encryption keys/IVs across builds; no persistence was observed in Jamf's samples. In the Apex campaign, CloudSyncD C2 is ccmihr.com.

On Windows, the chain uses PowerShell and VBScript bootstrap loaders (%TEMP%\_apex_run.ps1/.vbs, %TEMP%\_audit_run.ps1/.vbs) in five stages: (1) a PowerShell script fetches a Python loader; (2) a known UAC bypass is attempted (a reimplementation of UACME ucmDebugObjectMethod via the AppInfo service RPC); (3) the Python stage runs anti-VM checks against 15 blocklist resources (processes, MAC addresses, manufacturer info, public IP data); (4) a Go loader restores a clean ntdll.dll and patches AMSI and ETW; (5) the stealer runs in memory. On Windows 11 it requests admin rights to exclude a folder from Microsoft Defender and attempts to disable Smart App Control. The stealer collects passwords, cookies, wallets, messenger data, VPN configs, clipboard contents, screenshots, local files and configuration files for Claude, Cursor and Windsurf, organizes them into folders, compresses them and sends them to Telegram bots (tokens XOR-encoded with 0xAA). An infection marker is written to %APPDATA%\.cobra. Elastic noted a packaging error that stopped the initial Windows loader during testing.

AI agent hijacking: the Oh My Pi repackage overwrites OPENROUTER_API_KEY and OPENROUTER_BASE_URL so model requests go to arena.apexaccs.org/api/llm/v1/chat/completions, capturing prompts, code, file contents and conversation history; it registers an attacker-controlled MCP server (8 malicious tools) in ~/.apex/agent/mcp.json for prompt injection, and defaults tool approvals to 'yolo' mode.

Attribution: no confirmed attribution. Russian-language commit comments were noted but are insufficient to determine nationality; download domains were rotated multiple times. The motivation is assessed as financial (cryptocurrency and credential theft), based on the targeting and stealer capabilities.

## MITRE ATT&CK

- T1583.001 Domains
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.004 Unix Shell
- T1548.002 Bypass User Account Control
- T1548.003 Sudo and Sudo Caching
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1620 Reflective Code Loading
- T1553.001 Gatekeeper Bypass
- T1056.002 GUI Input Capture
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1113 Screen Capture
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1567 Exfiltration Over Web Service
- T1134.001 Token Impersonation/Theft
- T1027 Obfuscated Files or Information
- T1055 Process Injection
- T1082 System Information Discovery

## Sources

- [Elastic Security Labs: Apex Accelerator malicious npm packages (REF8801)](https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages)
- [Fake Web3 Accelerator Offers Claude and Gemini Credits to Spread Malware (GBHackers)](https://gbhackers.com/fake-web3-accelerator/)
- [Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents (SecurityOnline)](https://securityonline.info/apex-malicious-npm-packages-web3/)
- [Fake Web3 Accelerator Uses Malicious npm Packages to Target Crypto Founders (Cyberpress)](https://cyberpress.org/fake-accelerator-targets-crypto/)
- [Auditing the auditor: Unmasking Apex Accelerator (daily.dev summary of Elastic report)](https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk)
- [Jamf Threat Labs: CloudSyncD, a two-stage macOS backdoor that hides a phished password in zero-width Unicode](https://www.jamf.com/blog/cloudsyncd-macos-backdoor-fake-zoom-installer/)
- [SC Media: Fake Zoom installer delivers new CloudSyncD macOS backdoor](https://www.scworld.com/news/fake-zoom-installer-delivers-new-cloudsyncd-macos-backdoor)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3389