A Deceptive Scheme Targeting Cryptocurrency Startups: The Apex Arena Incident
A sophisticated campaign recently unfolded in the world of cryptocurrency, where threat actors successfully impersonated a Web3 venture-capital accelerator. This group strategically targeted cryptocurrency start-ups, developers, and founders by offering enticing promotions such as free credits for Claude and Gemini, AI coding tools, and smart-contract security audits. The operation, operating under the guise of legitimacy, claimed to support more than 200 portfolio projects and boasted an impressive fundraising total of over $124 million. In addition, it promoted services including founder assessments, security audits, job listings, and direct messaging for investor relations.
Underneath this polished facade, however, lay a sinister reality. The group distributed malicious npm packages designed to install backdoors on macOS systems and information stealers on Windows devices. Notably, Elastic Security Labs identified two key packages—@apexacc/cli and @apexacc/audit. These packages purported to serve as an AI coding assistant and a Web3 audit suite, respectively, but instead of providing legitimate services, they were vehicles for cybercriminal activity.
Upon installation, these malicious packages downloaded executables specific to the user’s platform, contacted infrastructure controlled by the attackers, and executed commands remotely. Elastic’s investigation revealed that out of 1,363 files, 1,351 matched the original upstream project, indicating a tactic of disguise by the attackers. An additional bootstrap component misleadingly redirected model traffic labeled with OpenRouter through the attackers’ infrastructure, granting them potential access to prompts, conversation histories, code snippets, and outputs submitted via the AI assistant.
Interestingly, the legitimate “Oh My Pi” project, which is a genuine multi-provider coding agent, was exploited as a cover for the attackers’ malicious fork. The modified client persistently registered an attacker-controlled Model Context Protocol (MCP) server. This server could expose tools and instructions to AI clients, allowing the attackers to control the descriptions and prompts provided to users, thereby significantly expanding their operational surface.
Testing the integrity of the so-called investment scoring capabilities of the services revealed further deception. Elastic submitted a fictitious project that lacked any repository, team data, contract address, or market information, and yet the service returned an “Apex Score” of 51 out of 100 across five categories. Notably, it acknowledged that its AI scoring system was unavailable, leading investigators to conclude that the uniform score was likely a fabricated placeholder result.
The @apexacc/audit package claimed to provide an extensive suite of 18 Web3 security-testing functions, including smart-contract auditing, honeypot analysis, and token-risk evaluation. However, findings indicated that every published handler yielded hard-coded, randomized, or date-derived results rather than conducting the promised scans. For instance, the audit_full_contract function falsely claimed to have analyzed 847 lines of code, and the audit_honeypot function consistently concluded that tokens were not honeypots, regardless of the actual status.
The malicious campaign displayed its technical prowess on macOS by utilizing a Rust-based verifier to contact endpoints and retrieve server-selected commands. Subsequently, it downloaded installers linked to the notorious CloudSyncD malware family. Once installed, this malware requested administrator passwords through a fraudulent authorization dialog, conducted system reconnaissance, and contacted a command-and-control server for further instructions.
On Windows, the npm packages extracted PowerShell commands similarly from the verification endpoint. This process involved VBScript and PowerShell staging, ultimately leading to a multi-stage information stealer. The malicious components sought to elevate privileges, perform anti-virtual machine checks, and execute in-memory shell codes to exfiltrate data through Telegram.
The Apex Arena incident serves as a stark reminder of how trust can be exploited through the creation of AI-generated websites, cloned open-source tools, fake customer reviews, conference references, and realistic investor branding. The attackers did not resort to basic phishing emails; instead, they orchestrated a well-planned operation designed to appeal to high-value Web3 targets likely holding cryptocurrency wallets, signing keys, cloud credentials, source code, and API tokens.
Previous reports on related Apex infrastructure have documented similar malicious npm packages leveraging free LLM credit lures alongside repackaged coding tools to deliver macOS credential-stealing malware. The findings indicate that merely removing the malicious packages will not suffice, as the operators can easily republish under new names while maintaining the same underlying repositories, binaries, and command-and-control settings.
Consequently, organizations are urged to block the identified package names and associated domains immediately. They should also review endpoint telemetry for execution sequences linked to suspicious npm-installed tools and rotate credentials, API keys, cloud tokens, and wallet secrets if the packages were executed.
Developers are cautioned against installing AI, MCP, or security-audit tools based solely on social proof, free model credits, or appealing project branding, particularly if those packages download binaries during runtime or reroute LLM traffic through third-party endpoints. Ultimately, the Apex Arena incident underscores the evolving threats in the cybersecurity landscape, particularly in the rapidly growing and often vulnerable domain of Web3 technology.