Malware Activity
Fake “Apex Accelerator” Uses Malicious npm Packages to Backdoor Web3 Startups
A fake Web3 venture accelerator called “Apex Accelerator” (REF8801) is distributing Windows and macOS malware via malicious npm packages that claim to offer free AI credits, coding tools, and security audits for crypto startups. Two (2) core packages, @apexacc/cli (Apex Copilot CLI) and @apexacc/audit (Web3 Security Scanner), were advertised as Claude/Gemini-powered advisors and Model Context Protocol (MCP) security tool servers but instead install a macOS backdoor (CloudSyncD) and a custom Windows infostealer. The packages, published by “apexaccelerator” and linked to “apexaccs” GitHub and domains apexaccs[.]org/apexfdn[.]xyz, target Web3 founders via investment pitches and conference appearances (for example TOKEN2049). Once run, they send an OS-specific verification request to vrf.apexaccs[.]org and trigger platform-tailored infection chains. On Windows, this begins with a multi-stage PowerShell/PyInstaller/Golang loader chain that patches AMSI/ETW, unhooks ntdll, and exfiltrates broad system, wallet, browser, VPN, messenger, and FTP data via Telegram. On macOS, a bash script pulls a CloudSyncD dropper that phishes the user’s password to gain sudo, profiles the host, and fetches further tasks from ccmihr[.]com. The audit tools produce fake findings, and the CLI returns bogus scores. Both can also intercept OpenRouter LLM traffic and register an attacker-controlled MCP server, giving the operator access to prompts, code, and tool outputs and the ability to inject instructions into agents’ prompts.
Threat Actor Activity
Targeted Ads Used as Zero-Click Vector for Candiru Spyware
Citizen Lab has uncovered a zero-click spyware campaign, dubbed AdFection, in which Candiru spyware was delivered via targeted online advertisements, notably infecting at least forty-five (45) devices at Al Jazeera between 2024 and 2025. The operation uses Israeli ad firm “Discover‑Tech” as a bridge between mercenary spyware vendors and the ad ecosystem, as claimed in the report published by Citizen Lab. Discover‑Tech’s “Controlium” platform buys placements through mainstream ad exchanges, embedding JavaScript that, when an ad is simply rendered, contacts a “getAd/NOAS” server. Using IP, ad IDs, and other parameters, the server decides whether a device is a target. Once a device is deemed a target, selected users receive additional malicious code that profiles, de‑anonymizes, fingerprints, and, in Candiru’s case, triggers infection with no clicks required. Leaked Discover‑Tech infrastructure exposed billions of bid records, showing its ads on nearly 200,000 websites and apps and directing hundreds of thousands to millions of users to attacker‑controlled domains. Citizen Lab also linked Discover‑Tech to other surveillance actors like Dark Cartographer, which builds databases tying mobile ad IDs to phone numbers. Following the report, Google, IAB Europe, Beeswax, Eskimi, Vungle, and others removed Discover‑Tech from vendor registries and blocked its access.
- Security Week: Zero-click Spyware Campaign Article
- Bleeping Computer: Zero-click Spyware Campaign Article
- Citizen Lab: AdFection Discover-Tech Mercenary Spyware Report
Vulnerabilities
ConnectWise Supply Chain Attack Exposes Hundreds of Microsoft 365 Tenants and Disrupts Cloud Services
ConnectWise has suspended its Cloud Backup, SaaS Security, and Cloud Management services following a supply chain attack in which threat actors exploited compromised application credentials to gain unauthorized access to customer Microsoft 365 environments. According to Huntress, malicious activity dating back to October 13, 2026, involved nearly 1,000 Microsoft Entra tenants, with more than 300 successful authentications, although not all resulted in confirmed compromises. Attackers abused trusted application identities and existing permissions to bypass traditional MFA protections, obtain Microsoft Graph access tokens, and potentially access sensitive emails, SharePoint documents, OneDrive files, and Teams communications. Researchers also observed privilege escalation to Global Administrator and persistence mechanisms involving unauthorized client secrets added to trusted applications, although some activity could not be conclusively attributed to the same threat actor. A second, targeted wave of unsuccessful intrusion attempts focused on sixteen (16) tenants in the policy, national security, trade, and critical minerals sectors. The activity was associated with IP addresses 144.172.64[.]128, 144.172.64[.]99, and 144.172.64[.]60. In response, ConnectWise disabled seven (7) application identities and revoked affected credentials, reporting no evidence that encrypted customer backup archives were compromised or that malicious activity continued in its monitored environments following containment. However, scheduled backups, restoration capabilities, security monitoring, and cloud management functions remain unavailable, with no announced restoration timeline. CTIX analysts urge organizations to review Microsoft Entra authentication logs, audit application permissions and administrative role changes, and remove unauthorized credentials or persistence mechanisms, as previously issued access tokens and malicious configurations may remain active despite the service shutdown.
- Bleeping Computer: ConnectWise Compromise Article
- The Hacker News: ConnectWise Compromise Article
- SecurityWeek: ConnectWise Compromise Article
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
