OpenClaw Trap: AI-Assisted LuaJIT Malware Factory Targeting Developers & Gamers via GitHub Supply Chain
OpenClaw Trap (TL-2026-0275), also tracked as TroyDen's Lure Factory, is a high-severity supply-chain compromise, first published 2026-03-24 and last reviewed 2026-08-23. It is attributed to TroyDen with medium confidence, affects GitHub GitHub Repositories, maps to 25 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0275
- Threat ID
- TL-2026-0275
- Also known as
- TroyDen's Lure Factory, OpenClaw Trap, SmartLoader Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-24
- Last reviewed
- 2026-08-23
- Attribution
- TroyDen
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, gaming, cryptocurrency, software-development, education
- Target regions
- Global, North America, Europe, Asia Pacific
- Detection rules
- 9
- Indicators of compromise
- 33
- Updates
- 2026-08-23
Malware and tooling in OpenClaw Trap
Malware and tooling: Lumma Stealer - S1213, RedLine Stealer - S1240, SmartLoader, Prometheus Lua Obfuscator, nginx load-balanced C2 cluster
Netskope Threat Labs identified TroyDen’s Lure Factory, an AI-assisted malware campaign operating across 300+ GitHub delivery packages including a trojanized OpenClaw Docker deployer, phone trackers, gaming cheats, and Roblox scripts. The campaign distributes LuaJIT-based credential stealers using a two-component sandbox evasion design with Prometheus obfuscation, anti-analysis checks, and a 29,000-year sleep delay. Infrastructure includes 8+ C2 nodes in Frankfurt behind nginx load balancing, linked to LummaStealer and Redline credential theft payloads.
How OpenClaw Trap works
TroyDen’s Lure Factory is a sophisticated, AI-assisted malware distribution campaign discovered by Netskope Threat Labs in March 2026. The operation leverages over 300 trojanized GitHub repositories across multiple simultaneous campaigns targeting distinct victim demographics: software developers (via a fake OpenClaw Docker deployer), mobile users (via phone tracker utilities promoted on Telegram), and gamers (via fishing game cheat menus and Roblox script engines).
The campaign’s hallmark is its industrial-scale use of AI-generated content to create convincing repository READMEs, documentation, and github.io landing pages. Repositories are further legitimized through manufactured GitHub stars and forks, creating an illusion of community trust. The operator persona TroyDen has been active on Telegram since at least June 2025, promoting various lure packages.
The malware payload employs a two-component LuaJIT 2.1.0-beta3 loader architecture. The first component (Payload 0) performs environmental reconnaissance and sandbox evasion, while the second component (Payload 1) delivers the final credential-stealing payload. Both components are obfuscated using the Prometheus Lua Obfuscator, which encrypts strings and employs a virtual machine layer to resist static analysis.
The loader’s anti-analysis arsenal is extensive: it queries for debugger presence, checks system RAM to detect low-memory sandbox environments, measures system uptime to identify freshly-booted analysis VMs, enumerates SeDebugPrivilege to detect analyst tooling, queries the computer name for known sandbox identifiers, and implements a catastrophic 29,000-year sleep delay (approximately 9.15 x 10^11 seconds) designed to defeat timed sandbox detonation systems.
Upon successful evasion checks, the loader performs a geolocation preflight via ip-api.com to implement geographic fencing, captures a full 24-bit BMP desktop screenshot for victim profiling, disables WinINet proxy auto-detection through 4 registry writes to ensure reliable C2 communication, and establishes encrypted C2 beaconing. The C2 infrastructure consists of 8+ nodes hosted on SERVHOST-AS (ASN 207957) in Frankfurt, Germany, behind nginx load balancing. Communication uses PUT requests with multipart/form-data encoding for data exfiltration and receives encrypted task blobs via JSON objects.
The final payloads include LummaStealer and Redline Stealer variants capable of harvesting browser credentials, cryptocurrency wallet data, two-factor authentication tokens, and DPAPI-protected secrets. Persistence is achieved through Windows Scheduled Tasks named WindowsErrorReporting_<LoaderID> and file staging in %APPDATA% and %USERPROFILE%\Pictures directories.
Four GitHub accounts have been identified as active delivery vectors: AAAbiola (openclaw-docker campaign, active), mikenob39wang (phone-tracker campaign, active), B3RZ3RK (fishing-planet-enhanced-menu campaign, active), and coteyn (seeder account, dormant since December 4, 2025). The campaign represents a significant evolution in supply chain attacks, combining AI-assisted social engineering at scale with sophisticated multi-stage malware delivery.
MITRE ATT&CK techniques used in TL-2026-0275
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1573 Encrypted Channel
collection
T1074 Data Staged; T1113 Screen Capture
discovery
T1082 System Information Discovery; T1614 System Location Discovery
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
initial-access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
stealth
T1218 System Binary Proxy Execution
persistence
T1547 Boot or Logon Autostart Execution
credential-access
T1555 Credentials from Password Stores
resource-development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities
Affected products and versions in OpenClaw Trap
- GitHub — GitHub Repositories
Vulnerable versions: 300+ trojanized repositories across multiple accounts - Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - OpenClaw Project — OpenClaw Docker Deployer
Vulnerable versions: Trojanized versions distributed via AAAbiola account - Multiple — Web Browsers (Chrome, Firefox, Edge)
Vulnerable versions: All versions - credential stores targeted - Multiple — Cryptocurrency Wallets
Vulnerable versions: All browser-based wallet extensions
Remediation for OpenClaw Trap
Immediate actions
- Block all 9 identified C2 IP addresses at network perimeter (213.176.73.159, 217.119.129.122, 217.119.129.76, 89.169.12.241, 94.156.154.6, 217.119.129.121, 217.119.129.118, 217.119.129.99, 213.176.73.130)
- Search endpoint telemetry for lua.exe, lua51.dll, and compiler.exe execution chains
- Audit all recently cloned GitHub repositories for LuaJIT components (conf.txt, Launcher.bat, lua51.dll)
- Block outbound connections to ip-api.com/json/ from non-browser processes
- Scan for WindowsErrorReporting_* scheduled tasks with non-Microsoft executables
Workarounds
- Remove any cloned repositories from identified GitHub accounts (AAAbiola, mikenob39wang, B3RZ3RK, coteyn)
- Reset credentials for any accounts accessed from systems where SmartLoader artifacts are found
- Revoke and rotate DPAPI master keys on affected systems
- Disable WinINet proxy auto-configuration if not required by organization
Longer-term hardening
- Deploy EDR rules detecting LuaJIT interpreter spawning child processes or loading shellcode
- Implement GitHub repository vetting policies requiring manual security review before cloning unknown repos
- Monitor for Prometheus-obfuscated Lua bytecode in downloaded archives
- Deploy behavioral detection for PUT-based multipart/form-data exfiltration to non-standard endpoints
- Implement application allowlisting to prevent unauthorized Lua interpreter execution
Weaknesses (CWE) in OpenClaw Trap
CWE-506, CWE-494, CWE-829
Timeline of OpenClaw Trap
- TroyDen operator persona first observed active on Telegram, beginning promotion of lure packages
- SmartLoader LuaJIT malware family gains widespread adoption as initial-access mechanism across financially motivated groups
- GitHub account coteyn (seeder account for campaign infrastructure) becomes dormant after seeding initial repositories
- TroyDen campaign expands to multiple simultaneous delivery vectors: openclaw-docker, phone-tracker, and fishing-planet-enhanced-menu
- C2 infrastructure scaled to 8+ nodes on SERVHOST-AS (ASN 207957) in Frankfurt with nginx load balancing
- AI-generated repository READMEs, documentation, and github.io landing pages deployed across 300+ repositories to maximize social engineering effectiveness
- Three simultaneous campaigns confirmed active: AAAbiola (openclaw-docker targeting developers), mikenob39wang (phone-tracker via Telegram), B3RZ3RK (fishing-planet gaming cheat)
- 9 C2 IP addresses, 4 GitHub accounts, and full malware component analysis published by Netskope enabling defender response
- Netskope Threat Labs publishes comprehensive analysis identifying TroyDen Lure Factory campaign, documenting full kill chain and C2 infrastructure
- As of 2026-05-29, this remains active: Netskope, Trend Micro and others confirm the SmartLoader/LuaJIT GitHub lure-factory ecosystem kept spawning trojanized repos through April 2026 with takedown-resilient C2, while its Lumma/Redline/StealC payloads rebounded post-2025 takedown. No TroyDen arrest or permanent infrastructure disruption reported.
Update history for TL-2026-0275
- 2026-08-23 — tweetfeed.live community intel: New TL_OSINT_Scan community intel: 1 newly-corroborated indicator(s), 21 community-related indicator(s).
Sources cited for OpenClaw Trap
- Netskope: OpenClaw Trap - AI-Assisted Lure Factory Targets Developers & Gamers
- Morphisec: Lua Malware Threat Analysis (related LuaJIT loader campaigns)
- Risky Biz: GitHub Malware Hosting Problem
- Security Blue Team: JIT Happens - Exposing LuaJIT Malware In The Wild
- Trend Micro: AI Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution
- ASEC: Distribution of SmartLoader Malware via Github Repository Disguised as Legitimate Project
- Gatewatcher: SmartLoader Large-scale Infiltration via GitHub
- Prometheus Lua Obfuscator - GitHub Repository
- OSINT Team: Lua-JIT SmartLoader Analyzing the GitHub Campaign Delivering Stealer
Threats related to OpenClaw Trap
- Fake OpenClaw Installers Distributed via Bing Search Poisoning and Malicious GitHub Repos Deploy Infostealers and GhostSocks Proxy Malware
- Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
- Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community
- Joyfill npm Supply-Chain Compromise: @joyfill/components and @joyfill/layouts Ship Obfuscated Worm-Like RAT and Credential Stealer
Detection coverage for TL-2026-0275
As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0275 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.