GhostClaw Malware Attacks macOS Crypto Wallets and Affects 178 Developers

WuSaidBlockchainW · 2026-03-23T01:42:01+00:00

Malware GhostClaw targets macOS crypto wallets, disguising itself as the OpenClaw CLI tool, and spreads through npm packages, infecting 178 developers. The software steals private keys and sensitive data, uses GhostLoader to achieve remote access, and also conducts attacks that lure victims via GitHub to counterfeit websites to steal funds.

WuSaidBlockchainW

2026-03-23 01:42:01

Abstract generation in progress

According to Cryptopolitan, malicious software called GhostClaw has been disclosed targeting macOS encrypted wallets. It was disguised as an npm package named OpenClaw CLI, uploaded by “openclaw-ai” on March 3 and removed on March 10, infecting 178 developers during that period. The software, once installed, steals private keys, wallet access, and sensitive data, including encrypted wallets, macOS Keychain passwords, cloud credentials, SSH keys, and AI configurations. It scans the clipboard every three seconds to obtain private keys, mnemonics, and transaction data. Using a two-stage payload called GhostLoader, it achieves data theft and remote access, sending data to Telegram, GoFile, and command servers. Meanwhile, OX Security revealed another attack where developers were lured to a fake openclaw[.]ai website via GitHub, receiving “$5000 CLAW tokens” to trigger wallet connection and fund theft. The related links point to token-claw[.]xyz and watery-compost[.]today. Both attacks rely on social engineering tactics.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.