REF8801 Campaign Distributes Malware via Malicious npm Packages

The threat actor REF8801 is orchestrating a supply chain attack using malicious npm packages disguised as legitimate Web3 development tools. By masquerading as a venture capital entity called the Apex Foundation, the attackers target cryptocurrency startup founders with promises of funding and security audits. The campaign, which has been active since at least early 2026, utilizes packages like @apexacc/cli and @apexacc/audit to infect Windows and macOS systems. Once installed, these packages execute platform-specific malware, including the CloudSyncD backdoor on macOS and custom information stealers on Windows. Beyond traditional data exfiltration, the malware actively targets the integrity of AI development environments by hijacking LLM traffic and manipulating Model Context Protocol (MCP) server configurations to intercept sensitive conversation history and prompts.

Attack Chain

1. Victim executes npm install of malicious packages such as @apexacc/cli or @apexacc/audit, which triggers an initial check via an HTTP POST request to vrf.apexaccs.org.
2. Windows infection chain fetches a Base64-encoded PowerShell script from 0auth-chromium.com, which subsequently retrieves the primary loader (bludness.exe).
3. The Windows loader performs UAC bypass using UACME's ucmDebugObjectMethod and executes anti-VM and anti-analysis checks.
4. The loader blinds security controls by patching AMSI and ETW, unhooking ntdll.dll, and loading final-stage shellcode into memory.
5. macOS infection chain retrieves a bash script that downloads a GZIP archive from verify.apexfdn.xyz containing the CloudSyncD dropper.
6. The dropper uses social engineering to phish the user for local administrative password, which is used to execute the payload with sudo privileges.
7. The malware intercepts developer LLM traffic and registers a malicious MCP server to exfiltrate prompts and tool outputs to attacker-controlled infrastructure.
8. Final data exfiltration of system metadata, browser credentials, and cryptocurrency wallets is conducted via Telegram (Windows) or custom C2 channels (macOS).

Impact

The campaign successfully compromises developer machines to steal sensitive credentials, session cookies, cryptocurrency assets, and proprietary code. Furthermore, by hijacking AI agent traffic, the attackers gain visibility into internal development workflows and can inject malicious instructions into LLM prompts, potentially leading to further supply chain compromise or unauthorized execution of developer tools.

Recommendation

• Audit npm project dependencies for presence of @apexacc/, @apexfdn/, or @copilot-mcp/* packages and remove immediately.
• Block all traffic to identified infrastructure domains: apexaccs.org, apexfdn.xyz, vrf.apexaccs.org, 0auth-chromium.com, ehegisnightmare.icu, verify.apexfdn.xyz, and ccmihr.com.
• Monitor for execution of unauthorized PyInstaller-compiled binaries and suspicious PowerShell commands involving UACME techniques.
• Review agent configuration files for unexpected MCP server registrations.