A fake Web3 venture accelerator called “Apex Accelerator” (REF8801) is distributing Windows and macOS malware via malicious npm packages that claim to offer free AI credits, coding tools, and security audits for crypto startups. Two (2) core packages, @apexacc/cli (Apex Copilot CLI) and @apexacc/audit (Web3 Security Scanner), were advertised as Claude/Gemini-powered advisors and Model Context Protocol (MCP) security tool servers but instead install a macOS backdoor (CloudSyncD) and a custom Windows infostealer. The packages, published by “apexaccelerator” and linked to “apexaccs” GitHub and domains apexaccs[.]org/apexfdn[.]xyz, target Web3 founders via investment pitches and conference appearances (for example TOKEN2049). Once run, they send an OS-specific verification request to vrf.apexaccs[.]org and trigger platform-tailored infection chains. On Windows, this begins with a multi-stage PowerShell/PyInstaller/Golang loader chain that patches AMSI/ETW, unhooks ntdll, and exfiltrates broad system, wallet, browser, VPN, messenger, and FTP data via Telegram. On macOS, a bash script pulls a CloudSyncD dropper that phishes the user’s password to gain sudo, profiles the host, and fetches further tasks from ccmihr[.]com. The audit tools produce fake findings, and the CLI returns bogus scores. Both can also intercept OpenRouter LLM traffic and register an attacker-controlled MCP server, giving the operator access to prompts, code, and tool outputs and the ability to inject instructions into agents’ prompts.