Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator is luring developers with bogus AI credits for Claude and Gemini while delivering stealers and backdoors through malicious npm packages—a supply-chain social engineering hybrid targeting dev environments.
Summary written by editorial AI · Source link below
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits.
"The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Editorial Analysis
The convergence of supply-chain poisoning with AI-themed social engineering creates a potent vector against developer environments, where a single compromised workstation can cascade into production.
Alert development teams to AI-credit-themed social engineering, audit npm dependencies for unexpected packages, and enforce allow-listing in build pipelines.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d