Introduction
It looked like a dream pitch for crypto founders. Free AI credits, a security audit, maybe a check from investors. Instead, the packages opened a side door, lifted data, and started reading the prompts AI agents were told.
What Happened?
Researchers traced a campaign that posed as a venture accelerator called Apex. It shipped two npm packages, one posing as an AI advisor for founders, the other claiming to be an audit server with 18 security tools. Neither did the job it advertised. On Windows, they dropped a custom data stealer that shipped loot out through a chat app. On Mac, they planted a backdoor. The group even showed up at a major crypto conference and claimed it had raised more than $124 million, all to look real.
What’s the Impact?
IOCs: the fake Web3 accelerator that hijacked AI agents
Published indicators from the Apex Accelerator (REF8801) campaign. Add these to your blocklists, EDR, and dependency controls, then hunt for the host artifacts below. Values are defanged for safe sharing.
Source: Elastic Security Labs, REF8801 / Apex Accelerator. Earlier July 2026 packages in the same operation delivered the AMOS (Atomic Stealer) family; CloudSyncD was first documented in September 2026. No IP addresses or SHA-1/MD5 hashes were published. Treat all values as time-bound and verify against the primary report before enforcement.
This one went beyond a typical stealer. The packages rerouted AI agent traffic to attacker-controlled servers, so attackers could read prompts, chat history, and source code in transit. Worse, the fake tooling could feed instructions back to the agent, steering its next move. Trust became the payload.
How to Avoid This
- Vet every package before installing
- Pin trusted registries only
- Lock down agent config files
- Review MCP server connections
- Watch outbound AI traffic
Your AI agents are now part of your attack surface. Who is watching them?
Supply-chain tricks like this hide inside the tools your team already trusts, and now they reach into the AI agents doing real work. That is exactly the gap governed AI teammates are built to close.
- A Red teammate hunts for exposed and tampered dependencies before an attacker turns them into a foothold.
- An AppSec teammate flags risky packages and unverified agent connections inside your pipeline, not weeks later.
- A SOC teammate triages strange outbound traffic and odd config changes the moment they surface.
- Every consequential action waits for your approval, with a full record of who decided what and why.
- It runs above the stack you already own, so you don’t have to rip anything out.
Attack. Harden. Prove. Repeat.
