{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/ref8801/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["REF8801"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["supply-chain","npm","malware","information-stealer","backdoor","ai-security"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe threat actor REF8801 is orchestrating a supply chain attack using malicious npm packages disguised as legitimate Web3 development tools. By masquerading as a venture capital entity called the Apex Foundation, the attackers target cryptocurrency startup founders with promises of funding and security audits. The campaign, which has been active since at least early 2026, utilizes packages like @apexacc/cli and @apexacc/audit to infect Windows and macOS systems. Once installed, these packages execute platform-specific malware, including the CloudSyncD backdoor on macOS and custom information stealers on Windows. Beyond traditional data exfiltration, the malware actively targets the integrity of AI development environments by hijacking LLM traffic and manipulating Model Context Protocol (MCP) server configurations to intercept sensitive conversation history and prompts.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eVictim executes npm install of malicious packages such as @apexacc/cli or @apexacc/audit, which triggers an initial check via an HTTP POST request to vrf.apexaccs.org.\u003c/li\u003e\n\u003cli\u003eWindows infection chain fetches a Base64-encoded PowerShell script from 0auth-chromium.com, which subsequently retrieves the primary loader (bludness.exe).\u003c/li\u003e\n\u003cli\u003eThe Windows loader performs UAC bypass using UACME's ucmDebugObjectMethod and executes anti-VM and anti-analysis checks.\u003c/li\u003e\n\u003cli\u003eThe loader blinds security controls by patching AMSI and ETW, unhooking ntdll.dll, and loading final-stage shellcode into memory.\u003c/li\u003e\n\u003cli\u003emacOS infection chain retrieves a bash script that downloads a GZIP archive from verify.apexfdn.xyz containing the CloudSyncD dropper.\u003c/li\u003e\n\u003cli\u003eThe dropper uses social engineering to phish the user for local administrative password, which is used to execute the payload with sudo privileges.\u003c/li\u003e\n\u003cli\u003eThe malware intercepts developer LLM traffic and registers a malicious MCP server to exfiltrate prompts and tool outputs to attacker-controlled infrastructure.\u003c/li\u003e\n\u003cli\u003eFinal data exfiltration of system metadata, browser credentials, and cryptocurrency wallets is conducted via Telegram (Windows) or custom C2 channels (macOS).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe campaign successfully compromises developer machines to steal sensitive credentials, session cookies, cryptocurrency assets, and proprietary code. Furthermore, by hijacking AI agent traffic, the attackers gain visibility into internal development workflows and can inject malicious instructions into LLM prompts, potentially leading to further supply chain compromise or unauthorized execution of developer tools.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit npm project dependencies for presence of @apexacc/\u003cem\u003e, @apexfdn/\u003c/em\u003e, or @copilot-mcp/* packages and remove immediately.\u003c/li\u003e\n\u003cli\u003eBlock all traffic to identified infrastructure domains: apexaccs.org, apexfdn.xyz, vrf.apexaccs.org, 0auth-chromium.com, ehegisnightmare.icu, verify.apexfdn.xyz, and ccmihr.com.\u003c/li\u003e\n\u003cli\u003eMonitor for execution of unauthorized PyInstaller-compiled binaries and suspicious PowerShell commands involving UACME techniques.\u003c/li\u003e\n\u003cli\u003eReview agent configuration files for unexpected MCP server registrations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T12:02:59Z","date_published":"2026-10-19T12:02:59Z","id":"https://feed.craftedsignal.io/briefs/2026-10-npm-ref8801/","summary":"The REF8801 threat actor is distributing malicious npm packages targeting Web3 developers to deploy information stealers, backdoors, and hijack AI agent traffic.","title":"REF8801 Campaign Distributes Malware via Malicious npm Packages","url":"https://feed.craftedsignal.io/briefs/2026-10-npm-ref8801/"}],"language":"en","title":"CraftedSignal Threat Feed - REF8801","version":"https://jsonfeed.org/version/1.1"}