cyber.hendryadrian.com
Security News · theregister.com

Fake OpenClaw Installers Promoted by Bing AI Deliver Vidar and GhostSocks

· Original article ↗

Summary

Huntress researchers linked fake OpenClaw installers promoted through Bing AI search suggestions to Vidar and GhostSocks payloads. The malicious GitHub repositories and accounts were reported and removed.

Key points

  • Fake repositories advertised “OpenClaw Windows” installers and were available on GitHub from February 2 to 10.
  • Huntress said a user reached a malicious repository through a Bing search suggestion and ran the fake installer.
  • The installer hid OpenClaw_x64.exe in a 7-Zip archive; execution dropped Rust loaders designed to run information stealers in memory.
  • Researchers identified cloudvideo.exe as a Vidar stealer targeting Telegram and Steam user details.
  • The serverdrive.exe payload was GhostSocks, which can turn infected hosts into TLS residential proxies.
  • Huntress described a previously unseen “stealth packer” with clues indicating in-memory execution, firewall rule changes, hidden scheduled tasks, and possible AntiVM checks.
  • Huntress reported the repositories and additional suspected malware-distribution accounts to GitHub; the researchers advised isolating AI agents and limiting their access and credentials.

Article Details

Event Type
Malware distribution campaign using fake OpenClaw Windows installers promoted through Bing AI search suggestions and malicious GitHub repositories.
Impact
The installers delivered Vidar, which steals Telegram and Steam user details, and GhostSocks, which turns compromised machines into TLS residential proxies used to route malicious traffic and access accounts with stolen credentials. Researchers also identified a previously unseen packer associated with in-memory payload execution, firewall rule additions, hidden scheduled tasks, and potential AntiVM checks. Huntress reported the repositories and accounts to GitHub, and they were removed.

People

Jai MintonHuntress threat analyst involved in analyzing the malicious repository and reporting findings about the campaign.Ryan DowdHuntress threat analyst involved in analyzing the malicious repository and reporting findings about the campaign.

Malware

GhostSocksAI suggestions to drive users to malicious repositories that delivered information stealers and the GhostSocks proxy.VidarHuntress researchers found Vidar (cloudvideo.exe), GhostSocks (serverdrive.exe), and a new “stealth packer” used to run loaders and in-memory payloads, and the malicious accounts and repos have been removed.

Vendors

GitHubOpenClaw’s popularity was weaponized by attackers who posted fake “OpenClaw Windows” installers on GitHub and leveraged Bing AI suggestions to drive users to malicious repositories that delivered information stealers

Products

Bing AIwas weaponized by attackers who posted fake “OpenClaw Windows” installers on GitHub and leveraged Bing AI suggestions to drive users to malicious repositories that delivered information stealers and theGitHubOpenClaw’s popularity was weaponized by attackers who posted fake “OpenClaw Windows” installers on GitHub and leveraged Bing AI suggestions to drive users to malicious repositories that delivered information stealersOpenClawOpenClaw’s popularity was weaponized by attackers who posted fake “OpenClaw Windows” installers on GitHub and leveraged Bing AI suggestions to drive users to malicious repositories that delivered information stealers

Tools

Stealth PackerHuntress researchers found Vidar (cloudvideo.exe), GhostSocks (serverdrive.exe), and a new “stealth packer” used to run loaders and in-memory payloads, and the malicious accounts and repos have been removed.

Related Articles