---
title: Fake Web3 accelerator 'Apex' (REF8801) ships a repackaged coding agent that routes LLM traffic to the attacker and registers its own MCP server | ctxsec
url: https://ctxsec.com/items/elastic-ref8801-apex-accelerator
description: ""
status: "confirmed (Elastic Security Labs)"
published: 2026-10-12
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/elastic-ref8801-apex-accelerator.md)

confirmed (Elastic Security Labs)

2026-10-12

### Fake Web3 accelerator 'Apex' (REF8801) ships a repackaged coding agent that routes LLM traffic to the attacker and registers its own MCP server

Elastic Security Labs says an operation posing as a Web3 accelerator (Apex / Apex Arena) courted crypto founders with free Claude and Gemini credits, an AI coding assistant and audits. Its npm packages were malicious from their first release. @apexacc/cli is a near-copy of the open-source Oh My Pi coding agent (1,351 of 1,363 files match). It overwrites OPENROUTER_BASE_URL so model requests go to arena.apexaccs[.]org, writes a persistent apex-copilot entry pointing at the attacker's MCP endpoint into ~/.apex/agent/mcp.json, and defaults tool approvals to 'yolo'. That means the attacker's server could hand back tool calls the agent would run, though Elastic didn't observe response substitution. @apexacc/audit's 18 'MCP security tools' return hard-coded or random findings. Both packages pull platform binaries whose 'verification' step (vrf.apexaccs[.]org) returns shell commands, delivering CloudSyncD on macOS and a Telegram-exfiltrating stealer on Windows.

Sources: [Elastic Security Labs (Oct 12)](https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages)