Full Report
Huntress warns of fake OpenClaw installers on GitHub deploying malware. Learn how these attacks happen, identify signs of infection, and stay protected.
Analysis Summary
# Tool/Technique: Fake OpenClaw Installer Campaign
## Overview
This threat campaign utilizes malicious GitHub repositories disguised as legitimate installers for **OpenClaw** (an open-source reimplementation of the Claw-foot engine). The campaign leverages search engine optimization (SEO) and Bing AI search poisoning to lead users to these repositories. Once executed, the installers deploy a combination of information stealers and the **GhostSocks** proxy tool to facilitate credential theft and bypass anti-fraud mechanisms.
## Technical Details
- **Type:** Malware Campaign / Information Stealer & Proxy Tool
- **Platform:** Windows, macOS
- **Capabilities:** Credential harvesting, proxying network traffic, anti-VM/anti-analysis evasion, and persistent access.
- **First Seen:** February 2, 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise] (via poisoned search results)
- [T1204.002 - User Execution: Malicious File]
- **[TA0002 - Execution]**
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- [T1569.002 - System Services: Service Execution]
- **[TA0005 - Defense Evasion]**
- [T1027.002 - Obfuscated Files or Information: Software Packing]
- [T1562.001 - Impair Defenses: Disable or Modify System Firewall]
- [T1497.001 - Virtualization/Sandbox Evasion: System Checks]
- **[TA0006 - Credential Access]**
- [T1555 - Credentials from Password Stores]
- **[TA0011 - Command and Control]**
- [T1090 - Proxy] (via GhostSocks)
## Functionality
### Core Capabilities
- **Information Theft:** Deploys variants of **AMOS (Atomic macOS Stealer)** for Mac users and unspecified Windows stealers to harvest browser credentials, cookies, and crypto wallets.
- **Traffic Proxying:** Installs **GhostSocks**, which converts the infected host into a residential proxy. This allows attackers to route malicious traffic through the victim’s IP address to bypass MFA and geo-fencing.
- **OpenClaw Targeting:** Specifically targets OpenClaw configuration files which often contain sensitive API keys and database credentials.
### Advanced Features
- **Stealth Packer:** A novel packer used in this campaign that:
- Decrypts and injects payloads directly into memory.
- Creates "Ghost" scheduled tasks that are hidden from standard management tools.
- Performs mouse-movement checks to ensure a human is present before execution (Anti-VM).
- **Firewall Manipulation:** Automatically adds rules to the Windows Firewall to allow C2 communication and proxy traffic.
## Indicators of Compromise
*Note: Specific hashes were not provided in the source text, but behavioral and network patterns are noted.*
- **File Names:** `OpenClaw_Installer.exe`, `Setup.zip` (hosted on malicious GitHub repos).
- **Network Indicators:**
- `ghostsocks[.]io` (Defanged)
- C2 communication related to GhostSocks proxy traffic.
- **Behavioral Indicators:**
- Unexpected `netsh advfirewall` commands to add allow-rules.
- Creation of scheduled tasks with unusual or hidden attributes.
- Outbound traffic on non-standard ports typical of residential proxy networks.
## Associated Threat Actors
- **BlackBasta:** Known to utilize GhostSocks in previous ransomware campaigns.
- **General Cybercriminals:** The campaign targets a broad demographic via SEO poisoning.
## Detection Methods
- **Signature-based detection:** Monitoring for the "Stealth Packer" signature and known AMOS/GhostSocks binaries.
- **Behavioral detection:**
- Identifying `schtasks.exe` usage for creating hidden or suspicious tasks.
- Monitoring for unauthorized modifications to the Windows Firewall.
- Detection of processes performing Anti-VM checks (e.g., monitoring `GetCursorPos` over time).
- **YARA rules:** Targeted at the decryption routine of the Stealth Packer.
## Mitigation Strategies
- **Prevention:** Train users to verify GitHub repository authenticity (star count, account age, and official project links).
- **Hardening:**
- Restrict the ability of standard users to modify firewall rules.
- Implement EDR solutions that detect process injection and suspicious scheduled task creation.
- Use FIDO2-based MFA which is more resistant to the proxy-based bypasses facilitated by GhostSocks.
## Related Tools/Techniques
- **AMOS (Atomic macOS Stealer):** Used for the macOS portion of this campaign.
- **Search Poisoning:** Similar to techniques used to distribute AMOS via fake ChatGPT/Grok AI pages.
- **Residential Proxies:** Similar functionality to tools like Glupteba or other proxy-botnets.