Apex Accelerator: Fake Web3 Audits Deliver npm Malware

On July 5, 2026, an npm package began distributing malware disguised as a development tool for crypto startups. This is not another supply chain compromise: the entire operation, dubbed Apex Accelerator, was built from the ground up to appear legitimate, with months of preparation, in-person events, and a suite of 18 security tools that generated completely fabricated reports. Elastic Security Labs and SafeDep have mapped a still-active command-and-control infrastructure, with a remote verification mechanism that lets attackers update payloads without publishing new packages.

How an Accelerator Scam Is Built

Elastic Security Labs' investigation began with an alert from its supply chain monitoring bot, which flagged suspicious behavior in the @apexacc/cli package. "On closer inspection, we discovered a package that was malicious from the moment it was published, not a supply chain compromise," the team stated. The distinction is fundamental: this was not a compromised legitimate account, but an identity entirely fabricated for the occasion.

The group invested time and resources to build credibility. It offered free AI credits, coding tools, and security audits — exactly what a Web3 startup seeks when preparing a funding round or due diligence. It attended in-person events, including TOKEN2049 Singapore, one of the crypto industry's premier gatherings. This social engineering strategy allowed it to bypass the initial wall of distrust that normally protects developers from unknown packages.

The Remote Verification Mechanism and Dynamic Control

The delivery technique reveals particular attention to evasion and operational flexibility. The npm packages do not contain the final payload directly: they download binaries from GitHub releases, with sizes ranging between 120 and 150 megabytes according to SafeDep. But the real differentiator is the bootstrap, which contacts hxxps://vrf.apexaccs[.]org/api/v1/vrf for instructions.

Code analysis shows the p:win32 field identifies the platform, while the JSON response provides exec, args, and cmd parameters to construct the command line to execute. On Windows the vehicle is PowerShell; on macOS a Rust helper. This architecture lets operators modify malware behavior in real time, without publishing new npm versions or waiting for victims to update. The package becomes a mere loader, while control resides entirely on the remote infrastructure.

The C2 server resides at IP address 172.93.185.150, hosted by xTom GmbH in Frankfurt according to SafeDep. The exposure of public endpoints such as /status, /register, and /subdomain/{slug}, protected by an X-Internal-Key gate, suggests a multi-tenant panel with subdomain provisioning for different campaigns or operators.

The Audit That Doesn't Audit: 18 Tools, Zero Real Scans

The insidious core of the operation lies in the @apexacc/audit package. Elastic verified that all 18 included security tools generate falsified results. Reports are produced through four mechanisms: hard-coded data, input formatting, date derivation, or pure randomization. None perform actual scans; none actually interrogate the target code.

This fabrication is not a secondary flaw: it is the central mechanism for instilling trust. Web3 startups operate in an ecosystem obsessed with compliance and verification, where a security audit is often a prerequisite for raising funds or listing tokens. The group understood that compliance anxiety itself could become the infection vector. By offering an apparently professional audit, it turned due diligence into a compromise opportunity.

In parallel, the group repackaged the legitimate Oh My Pi coding agent. The match is nearly total: 1,351 of 1,363 files correspond exactly to the original according to Elastic. The modification consists of intercepting LLM traffic, with requests to language models diverted to attacker-controlled services via OpenRouter. This exposes API keys and conversation content, an interception that strikes directly at the target developers' daily workflow.

The AMOS Family and Persistence Beyond Takedown

SafeDep provided forensic details of the macOS payload. It is an AMOS-family infostealer, delivered through a 707-line AppleScript that tricks the user into entering their system password, then exfiltrates data in a /tmp/osalogging.zip archive. The target is broad: browser credentials, crypto wallets (over 20), SSH keys, AWS and Kubernetes credentials, system keychain, Telegram data, and shell history.

Persistence is managed by a LaunchAgent named com.system.notifications.agent, which contacts the C2 with a 60-second polling interval. This high frequency ensures rapid operator response, but also increases the network footprint left on the compromised system.

The group's operational resilience emerges clearly from the timeline documented by SafeDep. The original @apexfdn/apex package was published on July 5, 2026 and accumulated 34 versions until July 21, when the npm security team removed it. The takedown did not interrupt the campaign: within 11 hours, at 08:04 on July 22, the dropper was republished under a new scope @copilot-mcp/apex, accompanied by over 20 versions published in roughly 8 hours. This second package was also removed, but the remote verification mechanism and binaries hosted on GitHub releases remain active according to sources.

"This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future." — npm security team, cited by SafeDep

Immediate Actions

• Check for the presence of packages @apexacc/cli, @apexacc/audit, @apexfdn/apex, and @copilot-mcp/apex in projects and lockfiles, removing them immediately even if the npm registry has replaced them with placeholders.
• Inspect network connections to vrf.apexaccs[.]org and IP 172.93.185.150, which sources confirm are still active, and remove any LaunchAgent named com.system.notifications.agent on macOS.
• Review API keys exposed to LLM services through Oh My Pi or similar tools, considering that traffic was intercepted by attacker-controlled infrastructure.
• Reassess trust placed in unverifiable security audits: the 18 tools in @apexacc/audit demonstrate that a professional-looking report can be entirely synthetic.

The Verification Paradox as Vulnerability

The Apex Accelerator operation exploits a structural contradiction in the Web3 sector. The very pressure to demonstrate security, transparency, and compliance — often on an accelerated timeline, driven by investors and community — has created fertile ground for those who can simulate these attributes. The group did not attack the supply chain: it rebuilt it from scratch, with every link designed to appear authentic.

Persistence beyond the npm takedown, guaranteed by independent C2 infrastructure and binaries hosted on separate platforms, shows the limits of reactive response. Sources do not document the number of actual victims, nor links to known threat actors. What remains confirmed is that building credibility took months, and the betrayal occurred only after trust was fully established. In a sector where reputation converts to capital, this is perhaps the most unsettling signal.

Information verified against cited sources and current as of publication.

Sources

• https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages
• https://safedep.io/malicious-copilot-mcp-apex-npm-macos-infostealer/
• https://www.token2049.com/