Date: 10/14/2026
Severity: High
Summary
Apex Accelerator is a fraudulent Web3 venture capital operation targeting cryptocurrency startups and founders through offers of free AI credits, coding tools, and security audits. The campaign distributes backdoored npm packages and code repositories, delivering CloudSyncD malware for macOS and a custom Windows information stealer that exfiltrates data through Telegram. It also intercepts AI model traffic through a repackaged coding agent and uses fake auditing tools that generate fabricated security findings, exploiting the credibility of AI-powered services to deceive victims.
Indicators of Compromise (IOC) List
Domains/URLs | apexaccs.org arena.apexaccs.org token.apexaccs.org vrf.apexaccs.org arena.apexfdn.xyz verify.apexfdn.xyz ccmihr.com 0auth-chromium.com ehegisnightmare.icu arenapex.cloud cloudmain365duo.top fdn4apex.com main.router-apex.com update.apex-arena-router.com |
Hash | 985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb
5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d
42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e
127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274
20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193
a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8
68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71
ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b
ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "ehegisnightmare.icu" or url like "ehegisnightmare.icu" or siteurl like "ehegisnightmare.icu" or domainname like "main.router-apex.com" or url like "main.router-apex.com" or siteurl like "main.router-apex.com" or domainname like "verify.apexfdn.xyz" or url like "verify.apexfdn.xyz" or siteurl like "verify.apexfdn.xyz" or domainname like "arenapex.cloud" or url like "arenapex.cloud" or siteurl like "arenapex.cloud" or domainname like "update.apex-arena-router.com" or url like "update.apex-arena-router.com" or siteurl like "update.apex-arena-router.com" or domainname like "fdn4apex.com" or url like "fdn4apex.com" or siteurl like "fdn4apex.com" or domainname like "0auth-chromium.com" or url like "0auth-chromium.com" or siteurl like "0auth-chromium.com" or domainname like "ccmihr.com" or url like "ccmihr.com" or siteurl like "ccmihr.com" or domainname like "arena.apexaccs.org" or url like "arena.apexaccs.org" or siteurl like "arena.apexaccs.org" or domainname like "arena.apexfdn.xyz" or url like "arena.apexfdn.xyz" or siteurl like "arena.apexfdn.xyz" or domainname like "cloudmain365duo.top" or url like "cloudmain365duo.top" or siteurl like "cloudmain365duo.top" or domainname like "vrf.apexaccs.org" or url like "vrf.apexaccs.org" or siteurl like "vrf.apexaccs.org" or domainname like "token.apexaccs.org" or url like "token.apexaccs.org" or siteurl like "token.apexaccs.org" or domainname like "apexaccs.org" or url like "apexaccs.org" or siteurl like "apexaccs.org" |
Detection Query 2 : | sha256hash IN ("20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193","985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb","68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71","127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274","ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b","42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e","ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e","5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d","a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8")
|
Reference:
Unmasking Apex Accelerator