backdoors

Fake Web3 Accelerator Distributes Malicious npm Packages Targeting Developers and AI Enthusiasts

Elastic researchers have uncovered a campaign in which threat actors operating a fake Web3 accelerator distributed malicious npm packages to developers and AI enthusiasts. The packages were promoted under the pretext of offering free artificial intelligence credits for Anthropic Claude and Google Gemini, coding tools, and security audits. Once installed, the packages deployed information-stealing malware and backdoors capable of compromising Windows and macOS systems, potentially leading to credential theft, session hijacking, and further compromise of AI agent traffic and development environments.