Malicious OpenClaw Skill Delivers Remcos RAT and GhostLoader

May 5, 2026 · Original article ↗

Summary

A deceptive OpenClaw skill identified in March 2026 used installation instructions to deliver Remcos RAT on Windows and GhostLoader across platforms, stealing credentials and other sensitive data from developer environments.

Key points

The campaign used a fake “DeepSeek-Claw” skill to trick AI agents or developers into running malicious installation instructions.
On Windows, the instructions download an MSI that sideloads a malicious DLL through a signed GoToMeeting executable and deploys Remcos RAT.
The Remcos loader patches ETW and AMSI, uses anti-analysis checks, and decrypts its payload in memory.
Remcos can log keystrokes, capture clipboard data, steal browser session cookies, and provide an interactive command channel.
Alternative installation instructions deliver GhostLoader through an obfuscated Node.js payload on macOS, Linux, and manual Windows workflows.
GhostLoader targets developer data, including macOS keychain information, SSH keys, cryptocurrency wallets, and cloud API tokens.
The article recommends scrutinizing third-party agent skills and monitoring their behavior.

Article Details

Attack Vectors: A deceptive “DeepSeek-Claw” OpenClaw skill embeds installation instructions that can be executed by an AI agent or user to download and run a Windows MSI installer for Remcos RAT.
The MSI places a malicious g2m.dll beside a legitimate GoToMeeting G2M.exe, which loads the DLL through DLL search order hijacking.
An alternate installation path uses Bash-based installers and npm lifecycle scripts to execute an obfuscated Node.js payload that installs GhostLoader.
GhostLoader uses spoofed sudo password prompts on macOS and Linux to solicit credentials.
Defensive Notes: Thoroughly check third-party plugins and OpenClaw skills before use.
Maintain strict behavioral monitoring of third-party skills.

Indicators of compromise

Type	Indicator	Context
IPV4	`146[.]19[.]24[.]131`	Remcos command-and-control server; the article lists port 2404.
MD5	`1c267cab0a800a7b2d598bc1b112d5ce`	Hash identified as the “Deepseek-Claw” OpenClaw skill.
MD5	`2a5f619c966ef79f4586a433e3d5e7ba`	Hash identified as the MSI installer that delivers Remcos RAT.
MD5	`2c4b7c8b48e6b4e5f3e8854f2abfedb5`	Hash identified as the Remcos RAT payload.
MD5	`cc1af839a956c8e2bf8e721f5d3b7373`	Hash identified as the shellcode loader used in the Remcos chain.
URL	`hxxp[:]//dropras[.]xyz/`	Alternative MSI download URL identified by the article.
URL	`hxxps[:]//cloudcraftshub[.]com/api`	MSI download URL used in the Remcos installation command.
URL	`hxxps[:]//github[.]com/Crestdrasnip/Claude-Zeroclaw`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/deborahikssv/Antigravity-claw`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/FinPyromancerLog/xcode-claw`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/Gentleatvice/seed-phrase-recover-BTC-ETH`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/GoliathSocialBoiler/kalshi-claw-skill`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/Heartflabrace/Doubao-Claw`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/helenigtxu/blooket`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/helenigtxu/TradingView-Claw`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/lunarraveneradicate/robinhood-auto-testnet`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/michelleoincx/Bunkr-Downloader-Python`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/michelleoincx/genspark[.]ai-openclaw`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/Needvainverter93/deepseek-claw`	Repository identified as the deceptive DeepSeek-Claw skill.
URL	`hxxps[:]//github[.]com/Rohit24567/HyperLiquid-Claw`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//github[.]com/sharonubsyq/trading-view-indicator-extension`	Repository listed among similar suspicious GitHub repositories.
URL	`hxxps[:]//trackpipe[.]dev`	GhostLoader command-and-control URL.