# OpenClaw Trap: AI-Assisted LuaJIT Malware Factory Targeting Developers & Gamers via GitHub Supply Chain

> Netskope Threat Labs identified TroyDen’s Lure Factory, an AI-assisted malware campaign operating across 300+ GitHub delivery packages including a trojanized OpenClaw Docker deployer, phone trackers, gaming cheats, and Roblox scripts. The campaign distributes LuaJIT-based credential stealers using a two-component sandbox evasion design with Prometheus obfuscation, anti-analysis checks, and a 29,000-year sleep delay. Infrastructure includes 8+ C2 nodes in Frankfurt behind nginx load balancing, linked to LummaStealer and Redline credential theft payloads.

- **Published:** 2026-03-24T12:00:00Z
- **Last reviewed:** 2026-08-23T21:31:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0275
- **ID:** TL-2026-0275
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TroyDen
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TroyDen’s Lure Factory is a sophisticated, AI-assisted malware distribution campaign discovered by Netskope Threat Labs in March 2026. The operation leverages over 300 trojanized GitHub repositories across multiple simultaneous campaigns targeting distinct victim demographics: software developers (via a fake OpenClaw Docker deployer), mobile users (via phone tracker utilities promoted on Telegram), and gamers (via fishing game cheat menus and Roblox script engines).

The campaign’s hallmark is its industrial-scale use of AI-generated content to create convincing repository READMEs, documentation, and github.io landing pages. Repositories are further legitimized through manufactured GitHub stars and forks, creating an illusion of community trust. The operator persona TroyDen has been active on Telegram since at least June 2025, promoting various lure packages.

The malware payload employs a two-component LuaJIT 2.1.0-beta3 loader architecture. The first component (Payload 0) performs environmental reconnaissance and sandbox evasion, while the second component (Payload 1) delivers the final credential-stealing payload. Both components are obfuscated using the Prometheus Lua Obfuscator, which encrypts strings and employs a virtual machine layer to resist static analysis.

The loader’s anti-analysis arsenal is extensive: it queries for debugger presence, checks system RAM to detect low-memory sandbox environments, measures system uptime to identify freshly-booted analysis VMs, enumerates SeDebugPrivilege to detect analyst tooling, queries the computer name for known sandbox identifiers, and implements a catastrophic 29,000-year sleep delay (approximately 9.15 x 10^11 seconds) designed to defeat timed sandbox detonation systems.

Upon successful evasion checks, the loader performs a geolocation preflight via ip-api.com to implement geographic fencing, captures a full 24-bit BMP desktop screenshot for victim profiling, disables WinINet proxy auto-detection through 4 registry writes to ensure reliable C2 communication, and establishes encrypted C2 beaconing. The C2 infrastructure consists of 8+ nodes hosted on SERVHOST-AS (ASN 207957) in Frankfurt, Germany, behind nginx load balancing. Communication uses PUT requests with multipart/form-data encoding for data exfiltration and receives encrypted task blobs via JSON objects.

The final payloads include LummaStealer and Redline Stealer variants capable of harvesting browser credentials, cryptocurrency wallet data, two-factor authentication tokens, and DPAPI-protected secrets. Persistence is achieved through Windows Scheduled Tasks named WindowsErrorReporting_<LoaderID> and file staging in %APPDATA% and %USERPROFILE%\Pictures directories.

Four GitHub accounts have been identified as active delivery vectors: AAAbiola (openclaw-docker campaign, active), mikenob39wang (phone-tracker campaign, active), B3RZ3RK (fishing-planet-enhanced-menu campaign, active), and coteyn (seeder account, dormant since December 4, 2025). The campaign represents a significant evolution in supply chain attacks, combining AI-assisted social engineering at scale with sophisticated multi-stage malware delivery.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1622 Debugger Evasion
- T1113 Screen Capture
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1583 Acquire Infrastructure

## Sources

- [Netskope: OpenClaw Trap - AI-Assisted Lure Factory Targets Developers & Gamers](https://www.netskope.com/blog/openclaw-trap-ai-assisted-lure-factory-targets-developers-gamers)
- [Morphisec: Lua Malware Threat Analysis (related LuaJIT loader campaigns)](https://www.morphisec.com/blog/threat-analysis-lua-malware/)
- [Risky Biz: GitHub Malware Hosting Problem](https://news.risky.biz/risky-bulletin-github-is-starting-to-have-a-real-malware-problem/)
- [Security Blue Team: JIT Happens - Exposing LuaJIT Malware In The Wild](https://www.securityblue.team/blog/posts/jit-happens-exposing-luajit-malware-in-the-wild)
- [Trend Micro: AI Assisted Fake GitHub Repositories Fuel SmartLoader and LummaStealer Distribution](https://www.trendmicro.com/en_us/research/25/c/ai-assisted-fake-github-repositories.html)
- [ASEC: Distribution of SmartLoader Malware via Github Repository Disguised as Legitimate Project](https://asec.ahnlab.com/en/89551/)
- [Gatewatcher: SmartLoader Large-scale Infiltration via GitHub](https://www.gatewatcher.com/en/lab/smartloader-large-scale-infiltration-via-github-uncovered-by-gatewatcher-purple-team/)
- [Prometheus Lua Obfuscator - GitHub Repository](https://github.com/prometheus-lua/Prometheus)
- [OSINT Team: Lua-JIT SmartLoader Analyzing the GitHub Campaign Delivering Stealer](https://osintteam.blog/lua-jit-smartloader-analyzing-the-github-campaign-delivering-stealer-f376274e4c1c)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0275