Fake startup accelerator offers free AI credits to spread malware

A group posing as a startup accelerator has been tricking developers into installing malware. It offered free AI credits for Anthropic Claude and Google Gemini, plus coding tools and security audits. The tools were delivered through npm packages and hit both Windows and macOS computers. Researchers at Elastic Security Labs published the findings.

What happened

npm is a huge public library where developers download ready-made pieces of code. The group called itself Apex Accelerator and targeted cryptocurrency startups and founders. Researchers track the operation as REF8801. Its website claimed to offer $235,000 in investments, grants and partnerships. It also appeared at TOKEN2049 in Singapore, which Elastic says was meant to build credibility.

Founders were invited to run a due diligence tool called @apexacc/cli. A second package, @apexacc/audit, claimed to offer 18 security tools. Neither worked as promised. The audit tool made up its findings, and the other returned an unsupported score for a fictitious project.

What the malware did

The real job of the packages was to install malware. On Macs, that was a backdoor called CloudSyncD, which gives an attacker a way back into the machine. On Windows, it was a custom information stealer that sent data out through Telegram. The packages also disguised a malware loader as an Apple app.

There was a second trick aimed at AI tools. The packages could redirect traffic from OpenRouter, a service that routes requests to AI models. They could also add an attacker-controlled MCP server to the victim's AI agent settings. An MCP server is an add-on that lets an AI assistant use outside tools.

Elastic says this gave the attacker a view of prompts, conversation history, code snippets and tool outputs. It could also feed instructions into the agent's prompts.

Who it affects

The main risk is to developers and small teams who use npm, Claude, Gemini or AI coding tools, especially anyone tempted by free credits or audits from a program they cannot verify. If a developer installs one of these packages, passwords and company access could be stolen.

Anyone who never installed these packages can relax about this specific case. The packages and their GitHub repositories are no longer accessible. Still, the campaign is not new. In late July 2026, SafeDep reported three other npm packages tied to the same operation that spread a Mac stealer.

What is not known

It is unclear who is behind it. Elastic spotted Russian-language comments in the code history, but says that is not enough to name anyone. The material also does not say how many people installed the packages.

What to do

The steps in the alert box above cover what to do now. The broader lesson is simple: a polished website, conference appearances and a generous offer do not prove a program is real.