Malicious "Lobster" Spyware GhostClaw Steals Developer Cryptocurrency Wallet Data, 178 People Infected

robot
Abstract generation in progress

Deep Tide TechFlow News, March 23 — According to CryptoNews, a malicious software called GhostClaw has recently targeted cryptocurrency wallets on macOS systems, primarily aiming at developers.

The malware was uploaded to the npm registry as a fake OpenClaw CLI installer package, with the account name openclaw-ai. It went live on March 3 and was taken down on March 10, infecting a total of 178 developers during that period. After installation, the malicious program tricks users into entering their macOS passwords to gain system access. It then downloads a second-stage payload, GhostLoader, from a remote command and control (C2) server, enabling data theft and remote access.

GhostLoader scans Chromium browsers, macOS Keychain, and local storage to extract private keys, mnemonics, SSH keys, cloud credentials, and API tokens for AI platforms. It monitors the clipboard every 3 seconds to capture sensitive data related to cryptocurrencies. The stolen data is transmitted to the attacker via Telegram, GoFile, and command servers.

View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin