Security researchers have uncovered a fake Web3 accelerator that targeted cryptocurrency founders with malicious npm packages, AI coding tools and fake security audits.

Elastic Security Labs published the investigation on October 12, 2026. The operation, called Apex or Apex Arena, presented itself as a Web3 accelerator offering free AI credits, coding tools, investor access and smart-contract security services.

Elastic found two malicious npm packages: @apexacc/cli and @apexacc/audit. The first posed as an AI coding assistant. The second advertised an MCP-based security-audit suite. When launched, the packages downloaded platform-specific executables for Windows or macOS and connected to attacker-controlled infrastructure.

A fake accelerator tried to #hack us today.
"Apex Accelerator" asked us to run their due diligence tool: npx @apexacc/cli. It dropped a hidden, encrypted malware loader disguised as an Apple app.
We caught it and lost nothing. Here's what happened 🧵

— hialex (@hialex_sol) September 14, 2026

Elastic linked to this founder account as an example of a startup describing its interactions with the fake accelerator.

The malware chain was not limited to stealing files. Elastic says the Windows path deployed an information stealer, while the macOS path delivered the CloudSyncD backdoor. The altered coding agent could also route model requests through infrastructure controlled by the operators and register a remote MCP server.

The fake audit tooling was also deceptive. Elastic reported that all 18 published audit tools returned fabricated results instead of performing the security checks they claimed to run. The researchers also found that 1,351 of 1,363 files in the altered coding-agent directory matched the legitimate open-source Oh My Pi project, helping the malicious additions blend into working software.

This NetworkChuck breakdown of the 2026 Axios npm compromise explains the same supply-chain risk: a package install can become the delivery mechanism for cross-platform malware.

Independent reporting published October 13 describes the same campaign and lists indicators tied to the malicious packages and payloads.

The incident fits a broader security problem around crypto software. BitcoinVersus.Tech recently covered ZEUS adding Lightning security fixes, Solana Web3.js v3 moving developers onto a newer client stack, and Core Lightning’s security update. In each case, the software supply chain matters as much as the protocol itself.

The confirmed finding is that the Apex packages were malicious from publication. Developers should avoid the identified packages and treat unofficial accelerator tooling, AI agents and security-audit packages as executable code that deserves the same scrutiny as any other dependency.

BitcoinVersus.Tech Editor’s Note:
We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support to help further secure the integrity of our research initiatives, please donate using the QR code provided

For best QR-code scanning results, please scan this donation code from a desktop or larger screen. Mobile screens may prevent camera recognition.