# Apex Accelerator uses malicious npm packages and attacker-controlled AI services to target Web3 founders

DevFeed: [Apex Accelerator uses malicious npm packages and attacker-controlled AI services to target Web3 founders](<https://devfeed.tech/articles/auditing-the-auditor-unmasking-apex-accelerator-85246.md>)

Original publisher: [Read original article](<https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages>)

Author: Jia Yu Chan,Daniel Stepanic

Published: 2026-10-12T00:00:00Z

Content type: article

Language: en

Sources: [Elastic Security Labs](<https://devfeed.tech/sources/elastic-security-labs.md>)

Topics: [npm security](<https://devfeed.tech/topics/npm-security.md>), [AI Infrastructure](<https://devfeed.tech/topics/ai-infrastructure.md>), [PowerShell](<https://devfeed.tech/topics/powershell.md>)

Tags: [ai-coding-assistant](<https://devfeed.tech/tags/ai-coding-assistant.md>), [ai-security](<https://devfeed.tech/tags/ai-security.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-analysis](<https://devfeed.tech/tags/malware-analysis.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [web3](<https://devfeed.tech/tags/web3.md>)

## AI overview

Elastic Security Labs investigated a fake Web3 accelerator distributing malicious npm packages disguised as coding and security-auditing tools. The packages deliver Windows and macOS malware, route coding-agent requests through attacker-controlled infrastructure, and generate fabricated audit findings. The research traces delivery chains and data collection, while distinguishing observed behavior from capabilities and execution failures.

## Source excerpt

REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery.