Loading story…
Threat actors abused the popularity of OpenClaw (an open-source, agentic AI framework that can browse the web and execute commands) by publishing fake Windows installers on GitHub and getting them surfaced prominently in Bing’s AI-powered search results. Users searching for “OpenClaw Windows” were directed to a malicious GitHub organization/repository (e.g., openclaw-installer) that delivered information-stealing malware and GhostSocks, with Huntress reporting it identified the activity after a user downloaded and executed the installer; the malicious GitHub assets were subsequently removed. The campaign’s effectiveness relied on trust signals—GitHub hosting, plausible organization naming, and AI search ranking—illustrating how quickly criminals can weaponize new, high-interest developer tools.
Separate from the installer campaign, security commentary highlighted broader enterprise risk from unauthorized agentic AI on endpoints: OpenClaw’s local, Node.js-based design and “skills” model can bypass procurement controls and expand system-level access, creating visibility and governance gaps for SecOps and threat hunting. Consumer-facing coverage also pointed to the emergence of NanoClaw as a smaller-codebase alternative positioned as potentially safer, emphasizing isolation/sandboxing as a key control when experimenting with agentic AI that can take real actions (email, calendar, payments, device control).
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Canary released a threat-hunting analysis focused on unmanaged OpenClaw use, malicious skills spawning shells, and credential access or exfiltration behaviors. The guidance framed OpenClaw as a shadow-IT and post-compromise risk and recommended detections and hardening controls.
Security reporting described an influx of malicious OpenClaw skills on the public ClawHub registry, including claims that a top-downloaded skill was actually a disguised infostealer. This expanded concern from fake installers to the broader OpenClaw extension ecosystem.
ZDNET reported on NanoClaw, an open-source personal AI agent designed with per-agent container isolation and a smaller codebase as a safer alternative to OpenClaw. The coverage also highlighted OpenClaw's history of security issues, including prompt-injection exposure, compromised skills, and exposed instances.
After the malicious repositories and associated accounts were reported, GitHub removed the original "openclaw-installer" repo and related entities. Reporting indicates the infrastructure was taken down around February 10.
Huntress uncovered multiple additional GitHub organizations and accounts tied to the fake OpenClaw installer campaign and reported them to GitHub. The activity showed the campaign extended beyond a single repository.
Victims who followed the fake GitHub installer workflow received malware instead of OpenClaw, including Vidar infostealer and GhostSocks proxy malware on Windows, while macOS instructions led to content associated with Atomic Stealer. The Windows chain used Rust-based loaders and in-memory execution to deploy payloads.
On February 9, Huntress observed Bing's AI-enhanced search results recommending a newly created GitHub repository for "OpenClaw Windows," directing users to the malicious installer. This search poisoning gave the fake repo credibility and increased the likelihood of victim downloads.
Threat actors created fake GitHub organizations and repositories, including "openclaw-installer," to impersonate OpenClaw and host trojanized Windows installers. The repositories were reportedly created around early February and were designed to look legitimate by reusing code from Cloudflare's moltworker project.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 38 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
7 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceredcanary.com
Open sourcezdnet.com
Open sourcego.theregister.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe threat actors abusing *AI-adjacent* and open-source distribution channels to deliver malware or manipulate automated agents. Straiker STAR Labs reported a **SmartLoader** campaign that trojanized a legitimate-looking **Model Context Protocol (MCP)** server tied to *Oura* by cloning the project, fabricating GitHub credibility (fake forks/contributors), and getting the poisoned server listed in MCP registries; the payload ultimately deployed **StealC** to steal credentials and crypto-wallet data. Separately, researchers observed attackers using trusted platforms and SaaS reputations for delivery and monetization: a fake Android “antivirus” (*TrustBastion*) was hosted via **Hugging Face** repositories to distribute banking/credential-stealing malware, and Trend Micro documented spam/phishing that abused **Atlassian Jira Cloud** email reputation and **Keitaro TDS** redirects to funnel targets (including government/corporate users across multiple language groups) into investment scams and online casinos. In parallel, research highlights emerging risks where **AI agents and AI-enabled workflows become the target or the transport layer**. Check Point demonstrated “**AI as a proxy**,” where web-enabled assistants (e.g., *Grok*, *Microsoft Copilot*) can be coerced into acting as covert **C2 relays**, blending attacker traffic into commonly allowed enterprise destinations, and outlined a trajectory toward prompt-driven, adaptive malware behavior. OpenClaw featured in two distinct security developments: an OpenClaw advisory described a **log-poisoning / indirect prompt-injection** weakness (unsanitized WebSocket headers written to logs that may later be ingested as trusted context), while Hudson Rock reported an infostealer incident that exfiltrated sensitive **OpenClaw configuration artifacts** (e.g., `openclaw.json` tokens, `device.json` keys, and “memory/soul” files), signaling that infostealer operators are beginning to harvest AI-agent identities and automation secrets in addition to browser credentials.
Jun 29, 2026
Security researchers reported that the *OpenClaw* self-hosted AI assistant ecosystem is being abused for malware distribution via **ClawHub**, a public registry for third-party “skills.” At least **14 malicious skills** uploaded over a short window masqueraded as crypto trading/wallet automation tools, but were designed to trick users into executing obfuscated setup commands that fetch and run remote scripts. Because OpenClaw skills are installed as executable code (not sandboxed) with access to local files and network resources, successful installs can enable credential theft and cryptocurrency wallet compromise on **Windows and macOS**, and one malicious listing reportedly reached prominent placement before removal, increasing the likelihood of accidental installs. Separate reporting also highlighted a related risk: a **1-click remote code execution (RCE)** issue affecting OpenClaw/Moltbot/ClawdBot was discussed in the security community, indicating that the same ecosystem is facing both supply-chain style extension abuse and potential direct exploitation paths. Organizations allowing developer or power-user adoption of OpenClaw should treat third-party skills as untrusted software, restrict installation sources, and monitor for social-engineering patterns such as “copy/paste this one-liner” installers that retrieve code from external servers—especially when tied to cryptocurrency-themed lures.
Jun 29, 2026
Threat actors are abusing interest in AI developer tools by impersonating installers and setup guides to trick users into executing malware. Fake installation-guide pages for Anthropic’s **Claude Code** were promoted via **Google Ads** to rank highly for searches like “Claude Code install/CLI,” leading Windows and macOS users to run copy-pasted commands in an **InstallFix** campaign (a variant of **ClickFix**) that ultimately deployed **Amatera** (an **ACR Stealer**-based MaaS infostealer). Push Security reported the malware steals browser-stored credentials, cookies, session tokens, and system information, and the infrastructure used legitimate hosting/CDN services (e.g., *Squarespace*, *Cloudflare Pages*, *Tencent EdgeOne*) to reduce suspicion. In a related AI-tool impersonation theme, JFrog identified a malicious **npm** package, `@openclaw-ai/openclawai`, posing as an **OpenClaw** installer that targets macOS users to steal credentials and establish persistent remote access. The package uses a `postinstall` hook to reinstall itself globally and registers a CLI via the `bin` field pointing to `scripts/setup.js`, which presents a fake installer UI and then prompts for the user’s system password via a bogus Keychain/iCloud authorization flow. The malware (self-identified as **GhostLoader**) was reported to collect browser data, crypto wallets, SSH keys, Apple Keychain databases, and iMessage history, while also deploying a **RAT** with **SOCKS5 proxy** capability and “live browser session cloning,” indicating a blend of credential theft and long-term access objectives.
Aug 21, 2026