Malicious npm Packages From Fake Web3 Accelerator Apex Deliver Stealers and Hijack AI Coding Agents

Elastic Security Labs uncovered a malicious campaign impersonating a Web3 accelerator named “Apex” that distributed two malicious npm packages and GitHub-hosted binaries to install a macOS backdoor (CloudSyncD) and a multi-stage Windows information stealer; the tools intercept LLM/agent traffic, steal credentials and wallets, and exfiltrate data (including via Telegram), while the actor used fake audit tools and a polished public presence to lure victims.