REF8801 npm Packages Deploy CloudSyncD Backdoor and Windows Stealer to Crypto Founders

The packages, published under npm user apexaccelerator and linked to GitHub apexaccs, posed as AI advisors and security scanners offering Claude and Gemini credits plus smart contract audits. Once executed they fetched platform-specific payloads from GitHub releases instead of delivering promised functionality. Elastic Security Labs and SafeDep both documented the same operator using earlier packages @apexfdn/apex and @copilot-mcp/apex that dropped Atomic Stealer variants in July 2026.

Russian-language comments appear in commit history, yet no infrastructure ties to known state groups. Domains apexaccs.org and apexfdn.xyz registered since April 2026 hosted the fake accelerator site claiming $235,000 investments. The group attended TOKEN2049 and hosted events to build surface legitimacy before directing developers to run the malicious CLI for due diligence.

Supply-chain attacks on npm continue to succeed because package metadata and GitHub presence substitute for verified provenance. Fabricated findings in the audit tool and repackaged coding agents that route traffic through attacker proxies show the operator prioritizes both credential theft and model-access hijacking. Similar patterns recur across crypto tooling where founders run unvetted dependencies under time pressure.

Next campaigns will likely reuse the apexaccs namespace or close variants within 90 days, targeting new wallet and trading-tool developers at upcoming conferences. Registry monitoring for packages claiming MCP servers or Claude integration remains the highest-yield detection surface.