# GhostClaw Supply Chain Campaign: Malicious GitHub Repos and AI Workflow SKILL.md Files Deliver GhostLoader macOS Infostealer via trackpipe[.]dev C2

> GhostClaw is an active supply chain campaign distributing the GhostLoader RAT through malicious GitHub repositories and npm packages disguised as legitimate developer tools. The attack chain uses curl|bash install scripts and AI workflow SKILL.md files to deliver a multi-stage credential stealer and RAT targeting macOS, Linux, and Windows developers, exfiltrating credentials, crypto wallets, SSH keys, browser data, and cloud tokens to the trackpipe[.]dev C2 infrastructure.

- **Published:** 2026-03-20T12:00:00Z
- **Last reviewed:** 2026-03-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0255
- **ID:** TL-2026-0255
- **Severity:** HIGH (CVSS 8.1)
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** GhostClaw Operator
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GhostClaw represents a sophisticated, multi-vector supply chain attack targeting software developers across macOS, Linux, and Windows platforms. First identified by JFrog Security Research on March 8, 2026, and further analyzed by Jamf Threat Labs on March 20, 2026, the campaign operates through two primary infection vectors: malicious GitHub repositories with curl|bash install scripts, and AI agent workflow exploitation via SKILL.md files compatible with OpenClaw and similar AI coding assistants.

The campaign maintains at least 10 malicious GitHub repositories impersonating legitimate tools including trading bots (TradingView-Claw, poly-market-kalshi-bot), developer SDKs (antigravity-sdk, xcode-claw), AI integrations (Claude-Zeroclaw, Doubao-Claw), and utilities (Bunkr-Downloader-Python). Some repositories accumulated hundreds of stars before payload injection, suggesting either social engineering or algorithmic manipulation.

The infection chain begins with an install.sh bootstrap script that downloads Node.js with disabled TLS verification (curl -fSLk), then executes setup.js which displays fake progress indicators mimicking legitimate SDK installation. The dropper prompts for system credentials via spoofed terminal prompts or AppleScript dialogs, validating stolen passwords against the actual OS using dscl (macOS), su (Linux), or PowerShell ValidateCredentials (Windows). Credentials are passed to subsequent stages via the NODE_AUTH_TOKEN environment variable.

The secondary payload is GhostLoader, an 11,700-line encrypted JavaScript framework retrieved from trackpipe[.]dev C2 using AES-256-GCM encryption. It installs to ~/.cache/.npm_telemetry/monitor.js (macOS/Linux) or %APPDATA%/.npm_telemetry/monitor.js (Windows), mimicking legitimate npm telemetry. Persistence is achieved through shell hooks appended to .zshrc/.bashrc/.bash_profile and crontab entries on Linux.

GhostLoader provides comprehensive RAT capabilities: credential harvesting from browsers (Chrome, Brave, Edge, Firefox, Opera, Vivaldi, Yandex), macOS Keychain databases, crypto wallets (Exodus, Electrum, Atomic, MetaMask, Phantom, Solflare), SSH keys, cloud credentials (AWS, Azure, GCP, Kubernetes), and developer tokens (npm, Git, GitHub CLI). It monitors clipboards every 3 seconds for cryptocurrency addresses and private keys. Full Disk Access exploitation via AppleScript enables harvesting of Apple Notes, iMessage chat.db, and Safari history.

C2 communication polls trackpipe[.]dev every ~25 seconds with 30% jitter, supporting commands including EXEC (shell execution), GRAB (file exfiltration), CLONE_START (headless browser session cloning via Chrome DevTools Protocol), PROXY_START (SOCKS5 proxy), UPDATE (self-update), and NUKE (self-destruct with evidence cleanup). Exfiltration uses three channels: direct upload to trackpipe[.]dev, Telegram Bot API for archives under 49MB, and GoFile.io for larger archives.

The npm package @openclaw-ai/openclawai (versions 1.5.14-1.5.15) bridges GitHub and npm distribution, with postinstall hooks creating redundant infection paths. Campaign segmentation uses unique UUIDs per repository variant and NODE_CHANNEL environment variables (anglmf, cryptoexth4) suggesting operational separation across lure categories.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1115 Clipboard Data
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1608 Stage Capabilities
- T1585 Establish Accounts

## Sources

- [Jamf Threat Labs: GhostClaw Expands Beyond npm to GitHub Repositories and AI Workflows](https://www.jamf.com/blog/ghostclaw-ghostloader-malware-github-repositories-ai-workflows/)
- [JFrog Security Research: GhostClaw Unmasked - Malicious npm Package Impersonating OpenClaw](https://research.jfrog.com/post/ghostclaw-unmasked/)
- [The Hacker News: Malicious npm Package Posing as OpenClaw Installer Deploys RAT](https://thehackernews.com/2026/03/malicious-npm-package-posing-as.html)
- [CSO Online: Devs Looking for OpenClaw Get Served a GhostClaw RAT](https://www.csoonline.com/article/4142922/devs-looking-for-openclaw-get-served-a-ghostclaw-rat.html)
- [eSecurity Planet: Fake OpenClaw npm Package Installs GhostClaw Malware](https://www.esecurityplanet.com/threats/fake-openclaw-npm-package-installs-ghostclaw-malware/)
- [CyberSecurity News: GhostClaw Mimic as OpenClaw to Steal Everything from Developers](https://cybersecuritynews.com/ghostclaw-mimic-as-openclaw/)
- [GBHackers: GhostClaw Masquerades as OpenClaw in Bid to Plunder Developer Data](https://gbhackers.com/ghostclaw-masquerades-as-openclaw/)
- [SOCRadar: GhostLoader Malware Spreads Through Fake OpenClaw npm Package](https://socradar.io/blog/ghostloader-malware-fake-openclaw-npm-package/)
- [ThaiCERT Advisory: Malicious npm Package OpenClaw Distributes GhostLoader](https://www.thaicert.or.th/en/2026/03/10/malicious-npm-package-openclaw-distributes-ghostloader-malware-to-steal-sensitive-data-on-macos/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0255