REF8801 is a threat campaign uncovered by Elastic Security Labs involving a group called Apex Accelerator that blends convincing Web3 service fronts with malicious npm packages. The attackers leverage attacker-controlled AI infrastructure to enhance credibility and deliver cross-platform malware. The campaign targets developers and users in the Web3/cryptocurrency ecosystem through supply chain compromise via the npm package registry. Malicious packages are used to establish footholds and deliver payloads across multiple operating systems. The use of AI infrastructure suggests a sophisticated and well-resourced threat actor. This represents a convergence of social engineering, supply chain attacks, and AI-assisted malware delivery.
