Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GhostLoader RAT-stealer via @openclaw-ai/openclawai

Malware Activity
First reported
Last updated
Happening score
H score 30
1 unique sources, 1 articles

Summary

Hide ▲

A malicious @openclaw-ai/openclawai npm package is delivering GhostLoader to macOS hosts, enabling credential theft, browser-session cloning, and persistent remote access. The package masquerades as an OpenClaw installer and uses a postinstall hook plus a fake iCloud Keychain prompt to harvest the victim's system password. It then retrieves an encrypted second-stage payload from trackpipe[.]dev and runs it in the background with SOCKS5 proxy and remote-command features. Stolen data can include Keychain items, browser cookies, wallets, SSH keys, and cloud credentials, and the malware exfiltrates them through the C2 server, Telegram Bot API, and GoFile.io.

Related Happenings

Compromised @asyncapi npm packages distributing the Miasma loader

Malware Activity
H score29 First: 15.07.2026 12:16 Last: 15.07.2026 12:16 Sources 1

About this happening: Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....

Open Happening

BoryptGrab infostealer variant delivered via fake GitHub repositories

Malware Activity
H score30 First: 14.07.2026 22:15 Last: 14.07.2026 22:15 Sources 1

About this happening: A BoryptGrab infostealer variant is being delivered through fake GitHub repositories, expanding a credential-theft operation that can drain browser, wallet, and messaging...

Open Happening

CrashStealer macOS information stealer activity

Malware Activity
H score10 First: 13.07.2026 20:36 Last: 13.07.2026 20:36 Sources 1

About this happening: CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...

Open Happening

TonRAT Node.js implant with TON blockchain C2

Malware Activity
H score24 First: 26.06.2026 12:27 Last: 26.06.2026 12:27 Sources 1

About this happening: TonRAT is using a Node.js implant to hide command-and-control lookups behind the TON blockchain API, increasing the chance that blocking and detection will fail. The a...

Open Happening

MacOS.Gaslight prompt-injection technique aimed at AI-assisted triage

Technical Analysis
H score23 First: 24.06.2026 17:00 Last: 24.06.2026 17:00 Sources 1

About this happening: macOS.Gaslight is a Rust-based macOS implant and information stealer assessed with high confidence as the work of North Korea-aligned threat actors. The sample uses ...

Open Happening

Timeline

  1. 09.03.2026 20:31 1 articles · 4mo ago

    Malicious OpenClaw-themed npm package uploaded

    Untyped Phase

    The malicious npm package @openclaw-ai/openclawai was uploaded to the npm registry by the user openclaw-ai on March 3, 2026. The package was built to masquerade as an OpenClaw installer, trigger a postinstall hook, point the executable to scripts/setup.js, and launch a fake installation flow that set up GhostLoader behavior on macOS hosts.

    Show sources
    Open in new tab
  2. 09.03.2026 20:31 2 articles · 4mo ago

    JFrog analyzes GhostLoader delivery and data theft capabilities

    Technical Analysis Update

    JFrog identified @openclaw-ai/openclawai as a malicious OpenClaw impersonator aimed at macOS developers and hosts, designed to steal system credentials, browser data, crypto wallets, SSH keys, Apple Keychain databases, and iMessage history while installing a persistent RAT with remote access capabilities, SOCKS5 proxying, and live browser session cloning. The analysis also tied the second-stage activity to trackpipe[.]dev and described multi-channel exfiltration through the C2 server, Telegram Bot API, and GoFile.io.

    Show sources
    Open in new tab