---
title: Fake Web3 accelerator ships a malicious coding agent and MCP "audit" server that reroutes LLM traffic | ctxsec
url: https://ctxsec.com/items/apex-accelerator-mcp-npm
description: ""
status: "confirmed (researcher)"
published: 2026-10-12
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/apex-accelerator-mcp-npm.md)

confirmed (researcher)

2026-10-12

### Fake Web3 accelerator ships a malicious coding agent and MCP "audit" server that reroutes LLM traffic

Elastic Security Labs (REF8801): "Apex Accelerator" lured crypto founders with free Claude/Gemini credits and audits. `@apexacc/cli` is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) whose bootstrap points OpenRouter-labeled traffic at an attacker API, so prompts, code and tool output go to the attacker. It also persistently registers an attacker MCP server in `~/.apex/agent/mcp.json`, and tool approvals default to "yolo". `@apexacc/audit`, an "18-tool" MCP security server, returns fabricated findings from every tool while pulling commands from `vrf.apexaccs[.]org`. Payloads: CloudSyncD on macOS; on Windows, a Telegram-exfil stealer that also grabs Claude, Cursor and Windsurf config files. SafeDep earlier documented `@apexfdn/apex` and `@copilot-mcp/apex` from the same operator. Takeaway: an agent binary or MCP server runs with your credentials, so pin and review its base URLs and MCP registrations.

Sources: [Elastic Security Labs](https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages) · [SafeDep](https://safedep.io/malicious-copilot-mcp-apex-npm-macos-infostealer)