TLDR Tech / InfoSec
GhostClaw steals crypto wallet data from devs
The @openclaw-ai/openclawai npm package, uploaded March 3 and active for a week before removal, infected 178 developers on macOS by posing as a legitimate OpenClaw CLI tool before deploying GhostLoader, a second-stage JavaScript payload retrieved from a C2 server that harvested crypto wallet keys, macOS Keychain passwords, SSH keys, cloud credentials, and AI platform API tokens for OpenAI and Anthropic. GhostLoader polled the clipboard every three seconds for private keys and seed phrases, cloned browser sessions for direct wallet access, and exfiltrated stolen data via Telegram, GoFile, and attacker-controlled command servers. A parallel GitHub-based campaign tagged developers in issue threads with fake $5,000 CLAW token airdrop offers, redirecting victims through token-claw[.]xyz to a phishing site at watery-compost[.]today that drained wallets on connection.
Read the full story