A supposed Web3 accelerator offered free AI credits, coding assistance and security audits to founders. Its packages began by downloading host executables; the modified agent carried unexpected endpoint and MCP configuration; the purported audit server fabricated reassuring output. These form one observed campaign but represent distinct trust boundary…
Inspect the ClaimsCase · DiggingBeagle record
A fake accelerator combined malware, altered agent routing and fabricated MCP audits
Elastic examined malicious npm packages offered by a fake Web3 accelerator: payload installers, a modified coding assistant that redirected model traffic, and 18 MCP security tools returning fabricated reports.
Scope
Investigator-controlled source and malware observations, not a victim or fund-loss census.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
Elastic investigated distributed malicious packages, modified routing and fabricated security tools, with some execution paths tested under controlled conditions. Numbers of actual victims or lost funds remain unconfirmed. Assessment uses the pinned Claims and source identities; public primary pages were not independently retrievable during this run. Impact remains unrated because field consequence or a comparable scoring rubric is not established.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP7-APEX-ROUTING · CLM-CP7-APEX-DELIVERY · CLM-CP7-APEX-FAKEAUDIT · Elastic Security Labs: Auditing the auditor, unmasking Apex Accelerator
At a glance
Total victims, actual exfiltrated customer data and investment losses are not established. Some staged execution paths did not complete in testing.
Limits and uncertaintyFull account
A supposed Web3 accelerator offered free AI credits, coding assistance and security audits to founders. Its packages began by downloading host executables; the modified agent carried unexpected endpoint and MCP configuration; the purported audit server fabricated reassuring output. These form one observed campaign but represent distinct trust boundary failures: installing arbitrary code, outsourcing sensitive model/tool traffic to an undisclosed endpoint, and treating synthetic security scores as checks. The source also documents controlled testing of the distributed programs. A failed or incomplete attacker bootstrap must not be narrated as a successful breach.
The audit facade and malicious package bootstrap should be measured separately. A fabricated score can be returned even when no scanner ran; the software supply-chain risk additionally depends on whether the installer obtained code execution in a particular environment.
Claims & evidence
CLM-CP7-APEX-ROUTINGThe modified coding agent configured an Apex-controlled OpenRouter base URL and persistent remote MCP configuration; a controlled file read was observed reaching infrastructure outside the intended provider route.supported
Basis: reported finding
- supportsElastic Security Labs: Auditing the auditor, unmasking Apex Acceleratorprimary disclosure
Remote MCP and LLM routing expand the software control surface
CLM-CP7-APEX-DELIVERYElastic identified @apexacc/cli and @apexacc/audit launchers that retrieved platform-specific executables, with a Windows infostealer and macOS CloudSyncD paths.supported
Basis: reported finding
- supportsElastic Security Labs: Auditing the auditor, unmasking Apex Acceleratorprimary disclosure
Malicious npm packages and delivery chains; Windows and macOS sections
CLM-CP7-APEX-FAKEAUDITAll 18 published @apexacc/audit tool handlers returned fabricated or synthetic findings rather than performing their advertised audits.supported
Basis: reported finding
- supportsElastic Security Labs: Auditing the auditor, unmasking Apex Acceleratorprimary disclosure
Fabricated MCP audit results and handler inspection
Unknowns and contradictions
- Total victims, actual exfiltrated customer data and investment losses are not established.
- Some staged execution paths did not complete in testing.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 150