Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
Intrusion set tracked by Elastic Security Labs, posing as a Web3 venture accelerator (Apex Accelerator / Apex Arena, Apex Foundation) to target cryptocurrency start-ups and founders. Lures offer investment, free AI credits and security audits, and lead victims to install npm packages (@apexacc/cli, @apexacc/audit) that fetch platform-specific payloads: the CloudSyncD backdoor on macOS and a custom information stealer exfiltrating through Telegram on Windows. The packages also repackage a legitimate coding agent to route LLM traffic through attacker infrastructure and register an attacker-controlled MCP server in the victim's agent configuration. Earlier npm packages from the same operation were reported by SafeDep in July 2026. Elastic makes no state or group attribution.
No exploited CVEs have been attributed to this threat actor yet.
Browse CVE Database