AN AI-assisted campaign is distributing more than 300 poisoned GitHub packages masquerading as an OpenClaw deployment tool, designed to lure developers and gamers into installing a Trojanised LuaJIT payload. Identified by Netskope Threat Labs, the operation—tracked as “TroyDen's Lure Factory”— spans multiple repositories and includes various packages that claim to deploy the viral OpenClaw tool and related assets, including a Telegram-promoted phone tracker and other lures.
The LuaJIT payload comprises a renamed Lua runtime and an encrypted script, with the Trojan capable of capturing screenshots, performing geolocation, exfiltrating data, and embedding credential-theft capabilities, according to Netskope. Netskope informed GitHub on 20 March, and two of the lures remain active: the Fishing Planet Cheat Menu and the phone-number-location-tracking-tool, with the campaign spreading widely across GitHub.
The malware exfiltrates data to a command-and-control server in Frankfurt, and the effort highlights how threat actors are using AI to scale malicious lure ecosystems, as noted by Elizabeth Montalbano, 24 March 2026.