HuntressPublished
“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information Stealers
By Jai Minton, Ryan Dowd
Excerpt
Special thanks to Greig Bailey for their effort in triaging and responding to this activity, and Aaron Deal for his tireless review and edits of this blog.
Summary
Information stealers continue to be an initial access vector for severe attacks against publicly facing systems, such as the Snowflake customer database compromise in 2024, and a Romanian oil pipeline operator compromise in 2026. This blog details an investigation into malicious GitHub repositories posing as OpenClaw installers that were available between the 2nd and 10th of February 2026. The OpenCla…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Huntress on huntress.com.
Mentioned in the excerpt
More from Huntress4
- Up a Creek Without a Command Line: Mapping an Akira Ransomware AttackHuntress · Published 6 Oct
- Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRATHuntress · Published 22 Jul
- Dissecting CrashFix: KongTuke's New ToyHuntress · Published 16 Jan
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataGen Digital · Published 8 Oct
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
