--- title: Auditing the auditor: Unmasking Apex Accelerator | daily.dev description: Elastic Security Labs uncovered a campaign dubbed REF8801 posing as a Web3 venture accelerator called Apex Accelerator, which distributed malicious npm... canonical: https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Auditing the auditor: Unmasking Apex Accelerator | daily.dev og:description: Elastic Security Labs uncovered a campaign dubbed REF8801 posing as a Web3 venture accelerator called Apex Accelerator, which distributed malicious npm... og:url: https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk og:image: https://api.daily.dev/og/posts/FqiIyBVgK.png og:image:alt: Auditing the auditor: Unmasking Apex Accelerator og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Auditing the auditor: Unmasking Apex Accelerator **[Elastic Security Labs](https://daily.dev/sources/elastic-security-labs)** · 28 min read · 0 upvotes · 0 comments ## Summary Elastic Security Labs uncovered a campaign dubbed REF8801 posing as a Web3 venture accelerator called Apex Accelerator, which distributed malicious npm packages (@apexacc/cli and @apexacc/audit) to cryptocurrency founders. The packages repackaged a legitimate open-source coding agent (Oh My Pi) and a fake MCP audit server, both of which secretly downloaded cross-platform malware: CloudSyncD for macOS and a multi-stage Windows information stealer that exfiltrates data via Telegram. The operation also intercepted OpenRouter LLM traffic by rerouting API requests through attacker-controlled infrastructure, giving it visibility into prompts and code. All 18 tools in the audit package generated fabricated security findings rather than real scans, and a remote scoring service returned fake scores for a fictitious test project. The group built fake credibility through sponsored events, fake reviews, and appearances at conferences like TOKEN2049. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Apex Accelerator npm package scam targeting Web3 startups? Apex Accelerator is a fake Web3 venture capital accelerator operation that distributed malicious npm packages @apexacc/cli and @apexacc/audit to cryptocurrency founders. The packages repackaged a legitimate open-source coding agent called Oh My Pi and a fake security audit MCP server, while secretly delivering CloudSyncD malware for macOS and a Windows information stealer that exfiltrates data through Telegram. _Developers vetting crypto tooling before installing it can follow ongoing supply chain threat coverage on daily.dev._ ### How does the Apex Accelerator malware intercept OpenRouter LLM API traffic? The @apexacc/cli bootstrap overwrites the OPENROUTER_API_KEY and OPENROUTER_BASE_URL environment variables so requests labeled as OpenRouter actually route to an attacker-controlled endpoint at arena.apexaccs.org. This lets the attacker capture prompts, conversation history, code snippets, and tool outputs, and register a malicious MCP server that can inject instructions into the agent's prompt. _Teams wiring AI coding agents into their workflows can track this kind of LLM traffic hijacking risk on daily.dev._ ### How do the fake @apexacc/audit security tools fabricate their findings? All 18 published tool handlers in the @apexacc/audit npm package return hard-coded, input-formatted, date-derived, or randomized reports instead of running real scans. For example, one tool claims Slither v0.10.4 analyzed 847 lines of code without ever running an analysis, and an aggregation tool returns a fixed composite score of 68/100 with literal GoPlus and Slither fields regardless of the actual project. _Anyone evaluating a third-party smart contract audit tool can follow similar fabricated-results investigations on daily.dev._ ## Similar posts on daily.dev - [Seven npm Packages Use Adspect Cloaking to Trick Victims Into Crypto Scam Pages](https://daily.dev/posts/seven-npm-packages-use-adspect-cloaking-to-trick-victims-into-crypto-scam-pages-uhsdnpw2b) · The Hacker News · 0 upvotes · 0 comments - [Supply-chain attacks take aim at your AI coding agents](https://daily.dev/posts/supply-chain-attacks-take-aim-at-your-ai-coding-agents-o8vsjrfrt) · CSO Online · 0 upvotes · 0 comments - [Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised](https://daily.dev/posts/mini-shai-hulud-strikes-again-317-npm-packages-compromised-u2ptexbxr) · Hacker News · 2 upvotes · 0 comments - [North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets](https://daily.dev/posts/north-korea-linked-npm-packages-impersonate-rollup-polyfill-tools-to-steal-developer-secrets-mvjcouuhx) · The Next Web · 2 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#mcp](https://daily.dev/tags/mcp), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Auditing the auditor: Unmasking Apex Accelerator","url":"https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk"},"datePublished":"2026-10-12T16:08:38.454Z","dateModified":"2026-10-12T16:10:48.229Z","description":"Elastic Security Labs uncovered a campaign dubbed REF8801 posing as a Web3 venture accelerator called Apex Accelerator, which distributed malicious npm...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/36c11adc812fac9abb366b8e6b5659bf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/36c11adc812fac9abb366b8e6b5659bf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Elastic Security Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Elastic Security Labs","logo":"https://media.daily.dev/image/upload/s--48fjDVq1--/c_limit,w_256/f_auto,q_auto/v1780213343/logos/elastic-security-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/elastic-security-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,mcp,npm","timeRequired":"PT28M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Elastic Security Labs","item":"https://daily.dev/sources/elastic-security-labs"},{"@type":"ListItem","position":3,"name":"Auditing the auditor: Unmasking Apex Accelerator"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/auditing-the-auditor-unmasking-apex-accelerator-fqiiybvgk#faq","mainEntity":[{"@type":"Question","name":"What is the Apex Accelerator npm package scam targeting Web3 startups?","acceptedAnswer":{"@type":"Answer","text":"Apex Accelerator is a fake Web3 venture capital accelerator operation that distributed malicious npm packages @apexacc/cli and @apexacc/audit to cryptocurrency founders. The packages repackaged a legitimate open-source coding agent called Oh My Pi and a fake security audit MCP server, while secretly delivering CloudSyncD malware for macOS and a Windows information stealer that exfiltrates data through Telegram. Developers vetting crypto tooling before installing it can follow ongoing supply chain threat coverage on daily.dev."}},{"@type":"Question","name":"How does the Apex Accelerator malware intercept OpenRouter LLM API traffic?","acceptedAnswer":{"@type":"Answer","text":"The @apexacc/cli bootstrap overwrites the OPENROUTER_API_KEY and OPENROUTER_BASE_URL environment variables so requests labeled as OpenRouter actually route to an attacker-controlled endpoint at arena.apexaccs.org. This lets the attacker capture prompts, conversation history, code snippets, and tool outputs, and register a malicious MCP server that can inject instructions into the agent's prompt. Teams wiring AI coding agents into their workflows can track this kind of LLM traffic hijacking risk on daily.dev."}},{"@type":"Question","name":"How do the fake @apexacc/audit security tools fabricate their findings?","acceptedAnswer":{"@type":"Answer","text":"All 18 published tool handlers in the @apexacc/audit npm package return hard-coded, input-formatted, date-derived, or randomized reports instead of running real scans. For example, one tool claims Slither v0.10.4 analyzed 847 lines of code without ever running an analysis, and an aggregation tool returns a fixed composite score of 68/100 with literal GoPlus and Slither fields regardless of the actual project. Anyone evaluating a third-party smart contract audit tool can follow similar fabricated-results investigations on daily.dev."}}]} ```