Elastic Security Labs has unmasked a malicious npm-package operation posing as a Web3 venture-capital accelerator that targeted cryptocurrency start-ups and founders. The fake "Apex" accelerator claimed over 200 portfolio projects and more than US$124 million in raised capital, and attracted victims with offers of free Claude and Gemini credits, coding tools and security audits, plus a dedicated in-person event invitation page. Elastic identified the malicious package @apexacc/cli from its supply-chain monitor, then linked the publisher to @apexacc/audit in a second campaign. The tools delivered information-stealing malware and backdoors for macOS and Windows, repackaged a legitimate coding agent to send model requests through attacker-controlled services, and generated fabricated security findings — all 18 tools in @apexacc/audit returned fake results. Malware delivered includes CloudSyncD for macOS and a custom Windows stealer exfiltrating data via Telegram. The campaign illustrates how AI-generated code and polished websites make illegitimate operations look established, and reinforces the need to validate tool provenance before granting supply-chain access.

• Source article