# Fake OpenClaw Installers Distributed via Bing Search Poisoning and Malicious GitHub Repos Deploy Infostealers and GhostSocks Proxy Malware

> Threat actors leveraged Bing AI search poisoning to direct users searching for OpenClaw to malicious GitHub repositories hosting trojanized installers. The campaign deployed Vidar stealer, PureLogs stealer, GhostSocks proxy malware on Windows, and Atomic macOS Stealer (AMOS) on macOS, targeting developer credentials, cryptocurrency wallets, and browser data.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0182
- **ID:** TL-2026-0182
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between February 2 and February 10, 2026, threat actors orchestrated a multi-platform malware distribution campaign by creating fraudulent GitHub organizations and repositories impersonating the legitimate OpenClaw project. The attackers exploited Bing AI search results to surface their malicious repositories at the top of search results for queries like 'OpenClaw Windows,' effectively weaponizing trust in both the Bing search engine and GitHub as a software distribution platform.

The Windows attack chain began with a trojanized installer named OpenClaw_x64.exe (original name: TradeAI.exe), distributed as a 7-Zip archive in the GitHub releases section. The installer contained largely legitimate code from Cloudflare's moltworker project to evade static analysis but deployed multiple malware payloads upon execution. A never-before-seen packer dubbed 'Stealth Packer' orchestrated the payload delivery, featuring capabilities including in-memory malware injection, Windows Firewall rule manipulation, hidden scheduled task creation, and anti-VM detection via mouse movement monitoring.

The primary payloads included: (1) Vidar stealer (cloudvideo.exe) which dynamically resolved its C2 infrastructure through a Telegram channel and Steam profile, targeting browser credentials, cryptocurrency wallets, and messaging application data; (2) PureLogs stealer (svc_service.exe), a Rust-based loader using the Stealth Packer with C2 communications to 185.196.9.98 (serverconect.cc); (3) An additional information stealer (WinHealhCare.exe) deployed across system directories; and (4) GhostSocks proxy malware (serverdrive.exe renamed to update.exe), which established TLS-encrypted SOCKS5 backconnect proxies to convert compromised machines into residential proxies for credential abuse and anti-fraud bypass.

GhostSocks maintained persistence through a registry run key (BackgroundTask) and established encrypted connections to two helper servers at 147.45.197.92 and 94.228.161.88. The malware stored its XOR-encrypted configuration in %AppData%\config with the key 'config.' An additional persistence mechanism used a scheduled task named EdgeUpdateHelper executing AdobeCloudHelper.exe daily.

The macOS campaign was distributed through the GitHub organization 'puppeteerrr' with a repository named 'dmg,' created the day after the Windows account takedown. The macOS payload was identified as an Atomic macOS Stealer (AMOS) variant delivered as a universal Mach-O binary (x86_64 + arm64). It exfiltrated stolen data to socifiapp.com and targeted files with extensions including .pdf, .txt, .env, .json, .xlsx, and .docx. Apple's XProtect detected this variant as MACOS.SOMA.CLBIFEA.

The threat actor infrastructure was prepared months in advance, with GitHub accounts created in September 2025 and self-promotion issues opened on the official OpenClaw repository on January 30, 2026. Within 8 hours of Huntress reporting the malicious repositories, GitHub removed them. However, additional copycat repositories appeared shortly after takedowns, demonstrating the threat actors' persistence and operational agility.

GhostSocks operates as a Malware-as-a-Service (MaaS) platform, first advertised on Russian-language cybercriminal forums in October 2023 at $150/license in Bitcoin. The Golang-based malware uses Garble and Gofuscator obfuscation tools and communicates over TLS 1.3-wrapped SOCKS5 tunnels.

---

**Revalidated on 2026-03-12**

Since initial publication, the fake OpenClaw installer campaign has proven to be part of a much larger, multi-vector attack ecosystem targeting the OpenClaw AI assistant and its developer community. Three significant developments have emerged:

**Expanded Attack Surface via ClawHub Skills (Jan-Feb 2026):** The ClawHavoc campaign, independently tracked by Repello AI and Trend Micro, poisoned over 1,184 malicious skills on ClawHub (OpenClaw's official skill marketplace). These skills used fake error messages and verification prompts to trick users — and notably AI agents themselves — into executing base64-encoded commands that deployed AMOS stealer. Trend Micro characterized this as a critical evolution: 'the attacker has shifted from deceiving humans into manipulating AI agentic workflows.' The campaign exploited ClawHub's weak publishing requirements (only a one-week-old GitHub account needed) with no code review or signing mandates.

**GhostClaw npm Supply Chain Attack (March 3-10, 2026):** A sophisticated malicious npm package '@openclaw-ai/openclawai' (internally tracked as GhostLoader/GhostClaw by JFrog) was uploaded on March 3, 2026 and downloaded 178 times before removal on March 10. The package featured an 11,700-line second-stage payload with capabilities far exceeding the original campaign: macOS Keychain database theft, real-time iMessage scanning, clipboard monitoring for 9 private key patterns, headless browser session cloning via CDP protocol, BIP-39 seed phrase detection, and a full RAT framework supporting SOCKS5 proxy establishment and remote self-destruction (NUKE command). Data was exfiltrated through three channels: direct C2 (trackpipe[.]dev), Telegram Bot API, and GoFile.io. Persistence was achieved through shell hook injection in .zshrc/.bashrc disguised as 'NPM Telemetry Integration Service.'

**Platform Response and Mitigations:** Apple released XProtect v5329 on February 10, 2026 with YARA rule MACOS.SOMA.CLBIFEA blocking the OpenClawBot AMOS variant. Microsoft adjusted Bing AI search result handling so that 'OpenClaw Windows' queries now return the official OpenClaw site. GitHub removed malicious repositories within 8 hours of Huntress's report. The npm registry removed GhostClaw after 7 days. GhostSocks continues active development despite the May 2025 DOJ/Microsoft/Europol LummaC2 infrastructure disruption (which seized 5 domains and 2,300+ proxy domains), having upgraded to TLS 1.3 encrypted C2 communications with dynamic configuration resilience.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1195 Supply Chain Compromise
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1573 Encrypted Channel
- T1071 Application Layer Protocol
- T1102 Web Service
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Beware of fake OpenClaw installers, even if Bing points you to GitHub](https://www.malwarebytes.com/blog/news/2026/03/beware-of-fake-openclaw-installers-even-if-bing-points-you-to-github)
- [How Fake OpenClaw Installers Spread GhostSocks Malware](https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer)
- [Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware](https://www.bleepingcomputer.com/news/security/bing-ai-promoted-fake-openclaw-github-repo-pushing-info-stealing-malware/)
- [Malware-laced OpenClaw installers get Bing AI search boost](https://www.theregister.com/2026/03/04/fake_openclaw_installers_malware/)
- [Latest OpenClaw Security Risk: Fake GitHub Repositories Used to Deploy Infostealers](https://securityboulevard.com/2026/03/latest-openclaw-security-risk-fake-github-repositories-used-to-deploy-infostealers/)
- [Bing-boosted fake OpenClaw installers deliver infostealers, GhostSocks malware](https://www.scworld.com/brief/bing-boosted-openclaw-installers-deliver-infostealers-ghostsocks-malware)
- [What to Know: GhostSocks Residential Proxy IoCs](https://spycloud.com/blog/on-the-hunt-for-ghostsocks/)
- [Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer](https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html)
- [GhostSocks Malware Exploiting SOCKS5 Proxy to Bypass Detection Systems](https://cybersecuritynews.com/ghostsocks-malware-exploiting-socks5-proxy/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0182