GhostClaw Supply Chain Campaign: Malicious GitHub Repos and AI Workflow SKILL.md Files Deliver GhostLoader macOS Infostealer via trackpipe[.]dev C2 — Threadlinqs Intelligence
As of 2026-05-30, GhostClaw Supply Chain Campaign: Malicious GitHub Repos and AI Workflow SKILL.md Files Deliver GhostLoader macOS Infostealer via trackpipe[.]dev C2 is a high-severity malware threat attributed to GhostClaw Operator (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0255 · Severity: HIGH · CVSS: 8.1 · Status: MONITORING · Category: MALWARE
Attribution: GhostClaw Operator · N/A · FINANCIAL
GhostClaw is an active supply chain campaign distributing the GhostLoader RAT through malicious GitHub repositories and npm packages disguised as legitimate developer tools. The attack chain uses
GhostClaw represents a sophisticated, multi-vector supply chain attack targeting software developers across macOS, Linux, and Windows platforms. First identified by JFrog Security Research on March 8, 2026, and further analyzed by Jamf Threat Labs on March 20, 2026, the campaign operates through two primary infection vectors: malicious GitHub repositories with curl|bash install scripts, and AI agent workflow exploitation via SKILL.md files compatible with OpenClaw and similar AI coding assistants.
The campaign maintains at least 10 malicious GitHub repositories impersonating legitimate tools including trading bots (TradingView-Claw, poly-market-kalshi-bot), developer SDKs (antigravity-sdk, xcode-claw), AI integrations (Claude-Zeroclaw, Doubao-Claw), and utilities (Bunkr-Downloader-Python). Some repositories accumulated hundreds of stars before payload injection, suggesting either social engineering or algorithmic manipulation.
The infection chain begins with an install.sh bootstrap script that downloads Node.js with disabled TLS verification (curl -fSLk), then executes setup.js which displays fake progress indicators mimicking legitimate SDK installation. The dropper prompts for system credentials via spoofed terminal prompts or AppleScript dialogs, validating stolen passwords against the actual OS using dscl (macOS), su (Linux), or PowerShell ValidateCredentials (Windows). Credentials are passed to subsequent stages via the NODE_AUTH_TOKEN environment variable.
The secondary payload is GhostLoader, an 11,700-line encrypted JavaScript framework retrieved from trackpipe[.]dev C2 using AES-256-GCM encryption. It installs to ~/.cache/.npm_telemetry/monitor.js (macOS/Linux) or %APPDATA%/.npm_telemetry/monitor.js (Windows), mimicking legitimate npm telemetry. Persistence is achieved through shell hooks appended to .zshrc/.bashrc/.bash_profile and crontab entries on Linux.
GhostLoader provides comprehensive RAT capabilities: credential harvesting from browsers (Chrome, Brave, Edge, Firefox, Opera, Vivaldi, Yandex), macOS Keychain databases, crypto wallets (Exodus, Electrum, Atomic, MetaMask, Phantom, Solflare), SSH keys, cloud credentials (AWS, Azure, GCP, Kubernetes), and developer tokens (npm, Git, GitHub CLI). It monitors clipboards every 3 seconds for cryptocurrency addresses and private keys. Full Disk Access exploitation via AppleScript enables harvesting of Apple Notes, iMessage chat.db, and Safari history.
C2 communication polls trackpipe[.]dev every ~25 seconds with 30% jitter, supporting commands including EXEC (shell execution), GRAB (file exfiltration), CLONE_START (headless browser session cloning via Chrome DevTools Protocol), PROXY_START (SOCKS5 proxy), UPDATE (self-update), and NUKE (self-destruct with evidence cleanup). Exfiltration uses three channels: direct upload to trackpipe[.]dev, Telegram Bot API for archives under 49MB, and GoFile.io for larger archives.
The npm package @openclaw-ai/openclawai (versions 1.5.14-1.5.15) bridges GitHub and npm distribution, with postinstall hooks creating redundant infection paths. Campaign segmentation uses unique UUIDs per repository variant and NODE_CHANNEL environment variables (anglmf, cryptoexth4) suggesting operational separation across lure categories.
Weaknesses (CWE)
CWE-506, CWE-494, CWE-327
Target sectors: technology, software-development, cryptocurrency, fintech, artificial-intelligence, open-source
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195, T1566, T1059, T1059, T1204, T1546, T1053, T1547, T1036, T1140