Fake Web3 Accelerator Hijacks AI Agent Traffic with npm Malware

Michael Miller · 2026-10-19

You know that feeling when a deal seems too good to be true? Like free AI credits for Anthropic Claude and Google Gemini, plus coding tools and a security audit thrown in? That's exactly what a fake Web3 accelerator is using to bait developers into installing malware. And it's working. Security researchers at Elastic recently uncovered a campaign where malicious npm packages are being pushed under the guise of a legitimate Web3 accelerator. Once installed, these packages deliver information stealers and backdoors to both Windows and macOS systems. ### How the Scam Works The attackers set up a fake accelerator website that promises free AI credits, coding tools, and even security audits. To access these "perks," developers are instructed to install npm packages. But those packages are anything but helpful. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic reported. Once installed, the malware can steal sensitive data like login credentials, crypto wallets, and browser cookies. It also establishes a backdoor, giving attackers remote access to the compromised system. ### Why This Matters for Antidetect Browser Users If you're using antidetect browsers to manage multiple online identities, this kind of malware is a nightmare. It can compromise your browser profiles, steal session cookies, and even hijack your AI agent traffic. Imagine your carefully crafted personas suddenly being controlled by someone else. Antidetect browsers are designed to protect your privacy by masking your digital fingerprint. But they can't protect you if you willingly install malware. That's why it's crucial to be vigilant about what you download and install, especially from unknown sources. ### The Rise of AI Agent Traffic Hijacking This campaign also highlights a growing trend: hijacking AI agent traffic. As more businesses and individuals use AI agents for tasks like customer service, data analysis, and content creation, attackers are finding ways to intercept and manipulate that traffic. By compromising a system, attackers can redirect AI agent requests to malicious servers, steal API keys, or even inject false information into the AI's responses. This can lead to data breaches, financial loss, and reputational damage. ### How to Protect Yourself - **Stick to official sources:** Only download npm packages from verified publishers and official repositories. Double-check the package name and publisher before installing. - **Use a reputable antidetect browser:** A good antidetect browser like Multilogin or GoLogin can help protect your identity, but it's not a substitute for safe browsing habits. - **Keep your software updated:** Regularly update your operating system, browser, and other software to patch known vulnerabilities. - **Enable two-factor authentication (2FA):** Use 2FA wherever possible to add an extra layer of security. - **Monitor your accounts:** Keep an eye on your accounts for unusual activity, and report anything suspicious immediately. ### The Bottom Line The fake Web3 accelerator scam is a reminder that cybercriminals are always finding new ways to exploit our trust. Whether you're a developer looking for free AI credits or a business using antidetect browsers to manage multiple accounts, staying informed and cautious is your best defense. Remember, if an offer seems too good to be true, it probably is. Stay safe out there.