Fake Web3 accelerator spread malware via npm packages

A fake Web3 accelerator distributed information stealers and backdoors for Windows and macOS through malicious npm packages, posing as free AI credits for Anthropic Claude and Google Gemini, coding tools and security audits. The packages also hijacked AI agent traffic, according to Elastic.

• Fake Web3 accelerator lured victims with free Claude and Gemini credits
• Malicious npm packages delivered infostealers and backdoors to Windows and macOS
• The packages also hijacked AI agent traffic
• Elastic uncovered the campaign