Auditing the auditor: Unmasking Apex Accelerator

As cited

Copy frozen at 2026-10-12 18:55 UTC (site build).

threat intel

Auditing the auditor: Unmasking Apex Accelerator

Elastic Security Labs discovered a sophisticated scam posing as a Web3 venture capital accelerator called Apex, targeting cryptocurrency founders with malicious npm packages @apexacc/cli and @apexacc/audit. The operation distributed information-stealing malware and backdoors for macOS and Windows, intercepted large language model (LLM) traffic through attacker-controlled servers, and published fabricated security audit findings. The threat actor built credibility through fake portfolios, websites, conferences, and reviews while delivering CloudSyncD malware for macOS and custom infostealers for Windows that exfiltrate data via Telegram.

Why it matters: Cryptocurrency and software developers using these npm packages or interacting with the fake accelerator face credential theft, system compromise, and data exfiltration; security teams should block these packages, monitor for indicators of compromise, and audit any installations of @apexacc/cli and @apexacc/audit for malware signatures and suspicious bootstrap activity.

Source published

2026-10-12 00:00 UTC

First seen by Cybersecurity Tracker

2026-10-12 17:52 UTC