Fake OpenClaw Installers Distributed via Bing Search Poisoning and Malicious GitHub Repos Deploy Infostealers and GhostSocks Proxy Malware
Fake OpenClaw Installers Distributed via Bing Search (TL-2026-0182), also tracked as OpenClaw Fake Installer Campaign, is a high-severity supply-chain compromise, first published 2026-03-06. It carries a reported Russia nexus and is not formally attributed, affects OpenClaw Project OpenClaw, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 36 indicators of compromise.
Key facts for TL-2026-0182
- Threat ID
- TL-2026-0182
- Also known as
- OpenClaw Fake Installer Campaign, GhostSocks OpenClaw Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-06
- Last reviewed
- 2026-03-06
- Attribution confidence
- NONE
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, financial, gaming
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in Fake OpenClaw Installers Distributed via Bing Search
Malware and tooling: AMOS, GhostSocks, PureLogs, Vidar
Threat actors leveraged Bing AI search poisoning to direct users searching for OpenClaw to malicious GitHub repositories hosting trojanized installers. The campaign deployed Vidar stealer, PureLogs stealer, GhostSocks proxy malware on Windows, and Atomic macOS Stealer (AMOS) on macOS, targeting developer credentials, cryptocurrency wallets, and browser data.
How Fake OpenClaw Installers Distributed via Bing Search works
Between February 2 and February 10, 2026, threat actors orchestrated a multi-platform malware distribution campaign by creating fraudulent GitHub organizations and repositories impersonating the legitimate OpenClaw project. The attackers exploited Bing AI search results to surface their malicious repositories at the top of search results for queries like 'OpenClaw Windows,' effectively weaponizing trust in both the Bing search engine and GitHub as a software distribution platform.
The Windows attack chain began with a trojanized installer named OpenClaw_x64.exe (original name: TradeAI.exe), distributed as a 7-Zip archive in the GitHub releases section. The installer contained largely legitimate code from Cloudflare's moltworker project to evade static analysis but deployed multiple malware payloads upon execution. A never-before-seen packer dubbed 'Stealth Packer' orchestrated the payload delivery, featuring capabilities including in-memory malware injection, Windows Firewall rule manipulation, hidden scheduled task creation, and anti-VM detection via mouse movement monitoring.
The primary payloads included: (1) Vidar stealer (cloudvideo.exe) which dynamically resolved its C2 infrastructure through a Telegram channel and Steam profile, targeting browser credentials, cryptocurrency wallets, and messaging application data; (2) PureLogs stealer (svc_service.exe), a Rust-based loader using the Stealth Packer with C2 communications to 185.196.9.98 (serverconect.cc); (3) An additional information stealer (WinHealhCare.exe) deployed across system directories; and (4) GhostSocks proxy malware (serverdrive.exe renamed to update.exe), which established TLS-encrypted SOCKS5 backconnect proxies to convert compromised machines into residential proxies for credential abuse and anti-fraud bypass.
GhostSocks maintained persistence through a registry run key (BackgroundTask) and established encrypted connections to two helper servers at 147.45.197.92 and 94.228.161.88. The malware stored its XOR-encrypted configuration in %AppData%\config with the key 'config.' An additional persistence mechanism used a scheduled task named EdgeUpdateHelper executing AdobeCloudHelper.exe daily.
The macOS campaign was distributed through the GitHub organization 'puppeteerrr' with a repository named 'dmg,' created the day after the Windows account takedown. The macOS payload was identified as an Atomic macOS Stealer (AMOS) variant delivered as a universal Mach-O binary (x86_64 + arm64). It exfiltrated stolen data to socifiapp.com and targeted files with extensions including .pdf, .txt, .env, .json, .xlsx, and .docx. Apple's XProtect detected this variant as MACOS.SOMA.CLBIFEA.
The threat actor infrastructure was prepared months in advance, with GitHub accounts created in September 2025 and self-promotion issues opened on the official OpenClaw repository on January 30, 2026. Within 8 hours of Huntress reporting the malicious repositories, GitHub removed them. However, additional copycat repositories appeared shortly after takedowns, demonstrating the threat actors' persistence and operational agility.
GhostSocks operates as a Malware-as-a-Service (MaaS) platform, first advertised on Russian-language cybercriminal forums in October 2023 at $150/license in Bitcoin. The Golang-based malware uses Garble and Gofuscator obfuscation tools and communicates over TLS 1.3-wrapped SOCKS5 tunnels.
---
**Revalidated on 2026-03-12**
Since initial publication, the fake OpenClaw installer campaign has proven to be part of a much larger, multi-vector attack ecosystem targeting the OpenClaw AI assistant and its developer community. Three significant developments have emerged:
**Expanded Attack Surface via ClawHub Skills (Jan-Feb 2026):** The ClawHavoc campaign, independently tracked by Repello AI and Trend Micro, poisoned over 1,184 malicious skills on ClawHub (OpenClaw's official skill marketplace). These skills used fake error messages and verification prompts to trick users — and notably AI agents themselves — into executing base64-encoded commands that deployed AMOS stealer. Trend Micro characterized this as a critical evolution: 'the attacker has shifted from deceiving humans into manipulating AI agentic workflows.' The campaign exploited ClawHub's weak publishing requirements (only a one-week-old GitHub account needed) with no code review or signing mandates.
**GhostClaw npm Supply Chain Attack (March 3-10, 2026):** A sophisticated malicious npm package '@openclaw-ai/openclawai' (internally tracked as GhostLoader/GhostClaw by JFrog) was uploaded on March 3, 2026 and downloaded 178 times before removal on March 10. The package featured an 11,700-line second-stage payload with capabilities far exceeding the original campaign: macOS Keychain database theft, real-time iMessage scanning, clipboard monitoring for 9 private key patterns, headless browser session cloning via CDP protocol, BIP-39 seed phrase detection, and a full RAT framework supporting SOCKS5 proxy establishment and remote self-destruction (NUKE command). Data was exfiltrated through three channels: direct C2 (trackpipe[.]dev), Telegram Bot API, and GoFile.io. Persistence was achieved through shell hook injection in .zshrc/.bashrc disguised as 'NPM Telemetry Integration Service.'
**Platform Response and Mitigations:** Apple released XProtect v5329 on February 10, 2026 with YARA rule MACOS.SOMA.CLBIFEA blocking the OpenClawBot AMOS variant. Microsoft adjusted Bing AI search result handling so that 'OpenClaw Windows' queries now return the official OpenClaw site. GitHub removed malicious repositories within 8 hours of Huntress's report. The npm registry removed GhostClaw after 7 days. GhostSocks continues active development despite the May 2025 DOJ/Microsoft/Europol LummaC2 infrastructure disruption (which seized 5 domains and 2,300+ proxy domains), having upgraded to TLS 1.3 encrypted C2 communications with dynamic configuration resilience.
MITRE ATT&CK techniques used in TL-2026-0182
collection
T1005 Data from Local System; T1560 Archive Collected Data
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion
exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1573 Encrypted Channel
discovery
T1082 System Information Discovery; T1518 Software Discovery
initial-access
T1189 Drive-by Compromise; T1195 Supply Chain Compromise
credential-access
T1528 Steal Application Access Token; T1555 Credentials from Password Stores
persistence
T1547 Boot or Logon Autostart Execution
resource-development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities
defense-impairment
Affected products and versions in Fake OpenClaw Installers Distributed via Bing Search
- OpenClaw Project — OpenClaw
Vulnerable versions: All - impersonated, not vulnerable - Microsoft — Windows
Vulnerable versions: 10; 11; Server 2019; Server 2022 - Apple — macOS
Vulnerable versions: Ventura; Sonoma; Sequoia
Remediation for Fake OpenClaw Installers Distributed via Bing Search
Immediate actions
- Block all C2 IPs at perimeter firewall: 147.45.197.92, 94.228.161.88, 185.196.9.98, and all listed campaign IPs
- Block domain serverconect.cc and socifiapp.com at DNS/proxy level
- Search endpoints for presence of Stealth Packer mutex StealthPackerMutex_9A8B7C
- Check for registry run key BackgroundTask under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- Scan for scheduled task EdgeUpdateHelper executing AdobeCloudHelper.exe
- Search for files named cloudvideo.exe, svc_service.exe, WinHealhCare.exe, serverdrive.exe, update.exe
- Quarantine any endpoint showing indicators of compromise
Workarounds
- Download OpenClaw only from official sources - never from search engine results
- Verify GitHub repository authenticity by checking account age, stars, and contributor history
- Use browser extensions that flag newly created GitHub repositories
- Disable Bing AI search suggestions for software downloads
Longer-term hardening
- Deploy EDR with behavioral detection for in-memory payload execution and Rust-based loaders
- Implement application allowlisting to prevent execution of unsigned binaries
- Monitor for SOCKS5 proxy traffic patterns indicating GhostSocks activity
- Enforce code-signing verification for all downloaded software
- Educate users about search engine poisoning risks and verifying software sources
- Monitor GitHub repositories for impersonation of internal or commonly used tools
- Implement network segmentation to limit lateral movement from compromised developer workstations
Weaknesses (CWE) in Fake OpenClaw Installers Distributed via Bing Search
CWE-494, CWE-506
Timeline of Fake OpenClaw Installers Distributed via Bing Search
- GhostSocks malware first advertised on Russian-language cybercriminal forums as MaaS platform at $150/license
- Threat actor GitHub accounts created in preparation for the campaign
- Self-promotion issues opened on the official OpenClaw GitHub repository to increase visibility
- Malicious GitHub repositories activated with trojanized OpenClaw installers in releases section
- SimpleClaw fake installer variant created under simple-claw organization
- Huntress threat analysts Jai Minton and Ryan Dowd detected the infection after user downloaded fake installer via Bing search
- Apple released XProtect version 5329 adding YARA rule MACOS.SOMA.CLBIFEA to detect the OpenClawBot AMOS variant, blocking the macOS payload on updated systems [Source: https://eclecticlight.co/2026/02/10/apple-has-released-an-update-to-xprotect-for-all-macos-26/]
- GitHub removed malicious repositories within 8 hours of Huntress report
- Additional openclaw-installer variant and macOS-targeting puppeteerrr/dmg repository appeared after initial takedown
- Trend Micro discovered 39 malicious OpenClaw skills on ClawHub distributing AMOS through AI agent social engineering, marking evolution from human deception to manipulating AI agentic workflows [Source: https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html]
- Malicious npm package ''@openclaw-ai/openclawai'' (GhostClaw) uploaded to npm registry, deploying multi-stage RAT with SOCKS5 proxy, browser session cloning, and macOS Keychain theft capabilities [Source: https://thehackernews.com/2026/03/malicious-npm-package-posing-as.html]
- Huntress published detailed technical analysis of the campaign including full IOC list
- The Register, Bleeping Computer, and BankInfoSecurity published coverage confirming Microsoft adjusted Bing AI search handling so queries now return OpenClaw''s official site instead of malicious repositories [Source: https://www.theregister.com/2026/03/04/fake_openclaw_installers_malware/]
- Bleeping Computer, The Register, and SC Media published coverage amplifying awareness
- JFrog Security Research published detailed technical analysis of GhostClaw npm package, revealing 11,700-line second-stage payload with AES-256-GCM encryption and BIP-39 seed phrase detection [Source: https://research.jfrog.com/post/ghostclaw-unmasked/]
- Malwarebytes published analysis warning users about the fake OpenClaw installer campaign
- The Hacker News published widespread coverage of GhostClaw malicious npm package, amplifying awareness across the developer community [Source: https://thehackernews.com/2026/03/malicious-npm-package-posing-as.html]
- Malicious ''@openclaw-ai/openclawai'' npm package removed from npm registry after 178 downloads over 7 days [Source: https://research.jfrog.com/post/ghostclaw-unmasked/]
- As of 2026-05-29, this OpenClaw-impersonation supply-chain campaign (GhostSocks/AMOS via fake installers) remains active and evolving, with no actor arrest or infrastructure seizure — only point mitigations (XProtect YARA, Bing fix, GitHub/npm removals). Copycat repos, the ClawHavoc ClawHub skills (1,184+) comment-pivot, and the March GhostClaw/GhostLoader npm RAT (Jamf 8+ new samples) extend the threat; no CVE applies.
Sources cited for Fake OpenClaw Installers Distributed via Bing Search
- Beware of fake OpenClaw installers, even if Bing points you to GitHub
- How Fake OpenClaw Installers Spread GhostSocks Malware
- Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware
- Malware-laced OpenClaw installers get Bing AI search boost
- Latest OpenClaw Security Risk: Fake GitHub Repositories Used to Deploy Infostealers
- Bing-boosted fake OpenClaw installers deliver infostealers, GhostSocks malware
- What to Know: GhostSocks Residential Proxy IoCs
- Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer
- GhostSocks Malware Exploiting SOCKS5 Proxy to Bypass Detection Systems
Threats related to Fake OpenClaw Installers Distributed via Bing Search
Detection coverage for TL-2026-0182
As of 2026-03-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0182 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.