Threat
Auditing the auditor: Unmasking Apex Accelerator
First reported · Discovered elastic.co
Page published · Page updated
Earliest dated coverage: 20 Oct 2026 · First observed: 21 Oct 2026 · Latest dated coverage: 20 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
REF8801 demonstrates how malicious developer tools can compromise endpoints and redirect AI-agent traffic, exposing sensitive prompts and code through attacker-controlled infrastructure.
REF8801 posed as Apex Accelerator to lure cryptocurrency founders and developers into installing malicious npm packages, including @apexacc/cli and @apexacc/audit, while distributing macOS and Windows malware. Elastic Security Labs found that the operation also repackaged a legitimate coding agent to route LLM requests through attacker-controlled services and supplied audit tools that fabricated security findings.
Summary
Elastic Security Labs documented an operation posing as Apex Accelerator, a Web3 accelerator targeting cryptocurrency start-ups and founders with offers of free AI credits, coding tools, and security audits. The operation cultivated a public presence over months and advertised an in-person event to reinforce its legitimacy. Its npm packages included @apexacc/cli and @apexacc/audit. Importantly, Elastic assessed @apexacc/cli as malicious from publication—not a legitimate dependency later compromised.[0][2]
The campaign combined conventional endpoint compromise with interference in AI-assisted development. Its tools delivered CloudSyncD for macOS and a custom Windows information stealer that exfiltrated through Telegram. Elastic also found that a legitimate coding agent had been repackaged to send model requests through attacker-controlled services. The purported auditing functionality was itself deceptive: all 18 tools in @apexacc/audit returned fabricated findings, and a separate CLI scoring test produced 51/100 for a fictitious project while reporting that the AI scorer was unavailable.[0][2]
The supplied evidence supports a malicious-package campaign, not a documented software-vulnerability exploitation case. The secondary report adds detailed claims about installer execution, Windows defense evasion, sudo phishing, OpenRouter redirection, and rogue MCP servers. Those implementation details are not independently corroborated by the supplied, truncated Elastic excerpt. Defenders should distinguish the primary report's established findings from these secondary-only details; the secondary article cites Elastic, so overlapping reporting should not be treated as independent confirmation.[0][2]
Attack chain
- 1. Establish a credible accelerator persona: The operation built a public presence over months and offered cryptocurrency founders AI credits, development tools, and security audits. Elastic also observed an advertised in-person event with a dedicated invitation page; the supplied excerpt does not establish attendance.[2]
- 2. Induce installation of malicious tooling: The accelerator pretext directed targets toward malicious npm tooling, including @apexacc/cli and @apexacc/audit. Elastic found that @apexacc/cli was malicious from publication. The secondary report states that npm installation executed embedded malicious installer scripts without explicit CVE exploitation.[0][2]
- 3. Deliver platform-specific malware: The tooling delivered CloudSyncD malware to macOS systems and a custom information stealer to Windows systems. These payloads provided an endpoint-compromise branch alongside the operation's AI-tooling abuse.[0][2]
- 4. Obtain elevated access and impair defenses: According to the secondary report, the Windows chain used UAC bypass, AMSI and ETW patching, and ntdll.dll unhooking, while the macOS backdoor phished sudo credentials. These details are secondary-source claims rather than findings corroborated by the supplied primary excerpt.[0]
- 5. Parallel branch: intercept AI-agent requests: Elastic reported that a repackaged legitimate coding agent sent model requests through attacker-controlled services. The secondary report further describes redirecting OpenRouter traffic and registering rogue MCP servers to expose prompts, code, conversation context, and tool outputs, with opportunities to influence subsequent agent actions. This is a parallel compromise path, not an established step occurring only after endpoint privilege escalation.[0][2]
- 6. Collect information and maintain external communications: The Windows information stealer exfiltrated through Telegram. The secondary report additionally describes persistent command-and-control channels and collection of browser credentials, session cookies, wallet secrets, clipboard contents, screenshots, and system information.[0][2]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-10-11 | Elastic Security Labs published its Apex Accelerator research, describing malicious npm tooling, cross-platform malware delivery, attacker-controlled AI request routing, and fabricated audit results.[2] |
| 2026-10-20 | Aviatrix published a secondary account of REF8801, citing Elastic and adding endpoint, MCP, network-control, and indicator details.[0] |
Actor profile
REF8801
The reporting associates REF8801 with the operation presenting itself as Apex Accelerator. Its documented targeting centered on cryptocurrency start-ups and founders, using accelerator benefits and security-audit offers to distribute malicious development tools. The supplied primary excerpt establishes the operational persona and targeting but does not establish a real-world operator identity, nationality, or affiliation.[0][2]
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| other | @apexacc/cli | Malicious npm package identified by Elastic. Hunt package inventories, lockfiles, installation records, and development environments for its presence or prior execution. No specific affected package-version range is supplied.[0][2] |
| other | @apexacc/audit | Campaign-associated malicious npm audit package. Elastic reported that all 18 of its tools returned fabricated findings.[0][2] |
| domain | ehegisnightmare.icu | Listed by the secondary report as a campaign-related destination to block. The supplied primary excerpt does not corroborate this domain or establish its precise role.[0] |
| domain | ccmihr.com | Listed by the secondary report as a campaign-related destination to block. The supplied primary excerpt does not corroborate this domain or establish its precise role.[0] |
| domain | 0auth-chromium.com | Listed by the secondary report as a campaign-related destination to block. The supplied primary excerpt does not corroborate this domain or establish its precise role.[0] |
Key takeaways
- The initial trust failure was adoption of deliberately malicious tooling under a convincing accelerator persona. Elastic explicitly distinguished this from compromise of an otherwise legitimate existing package.[2]
- Endpoint compromise and AI-request interception were complementary risks. The primary report establishes both cross-platform malware delivery and routing of coding-agent requests through attacker-controlled services.[2]
- A polished security tool can be part of the deception rather than a safeguard: the audit package's 18 tools returned fabricated findings, and the CLI scoring test produced an unsupported-looking assessment for a fictitious project.[2]
- Use the reporting at its actual confidence level. The supplied primary excerpt supports the central campaign findings, while detailed MCP behavior, endpoint evasion mechanisms, and the three domain indicators remain supported only by the secondary report.[0][2]
Defensive actions
- Block installation of @apexacc/cli and @apexacc/audit, and investigate systems with evidence of prior installation or execution.: The packages are identified as malicious campaign tooling, and Elastic specifically determined that @apexacc/cli was malicious from publication. Investigation should therefore consider execution exposure rather than look only for a later package compromise.[0][2]
- Review affected coding agents' model-request destinations and configurations; investigate unexpected OpenRouter routing and unauthorized MCP server entries.: Elastic established attacker-controlled routing through a repackaged coding agent. The secondary report specifically describes OpenRouter redirection and rogue MCP configuration, making configuration review relevant even when endpoint malware is not the first observable symptom.[0][2]
- Review historical connections to the three reported domains, apply blocking consistent with local indicator-validation procedures, and alert on unapproved Telegram Bot API traffic from affected development systems.: The secondary report supplies the domains as blocking targets, while both reports describe Telegram exfiltration by the Windows stealer. Domain-specific attribution remains single-source, so historical matches should be investigated in context.[0][2]
- On exposed Windows systems, investigate defense-tampering and UAC-bypass behavior; on exposed macOS systems, investigate CloudSyncD and suspicious sudo credential prompts.: The primary report establishes Windows and macOS malware delivery. The specific Windows evasion behaviors and macOS credential-phishing mechanism come from the secondary report and should be treated as investigative leads rather than independently verified implementation details.[0][2]
- Prioritize exposure review for browser credentials, session cookies, wallet secrets, clipboard data, and code or prompts processed by affected agents.: The secondary report identifies these collection categories, while Elastic independently establishes an information stealer and attacker-controlled model-request routing. Reviewing only conventional credential theft would miss the campaign's AI-workflow exposure.[0][2]
- Discard @apexacc/audit output as security assurance and independently reassess conclusions or project decisions based on its findings or the CLI's remote score.: Elastic found fabricated findings across all 18 audit tools. Its separate fictitious-project test also showed that a numeric score could be returned while the service reported its AI scorer unavailable; that observation does not establish that every project receives the same score.[2]