Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator campaign has been discovered distributing information-stealing malware and backdoors targeting both Windows and macOS systems. The attackers used malicious npm packages as the delivery mechanism, luring victims with promises of free AI credits for Anthropic Claude and Google Gemini, coding tools, and security audits. The malware delivered included information stealers and backdoors capable of hijacking AI agent traffic. The campaign was identified and reported by Elastic security researchers. This represents a supply chain attack leveraging the npm ecosystem combined with social engineering around AI and Web3 themes to increase credibility. The use of legitimate AI brand names (Claude, Gemini) as bait indicates sophisticated targeting of developers and tech-savvy users. Both major desktop operating systems are affected, broadening the potential victim pool significantly.