Fake OpenClaw Installers Delivered Information Stealers and GhostSocks
Summary
Huntress traced fake OpenClaw installers promoted in Bing AI results to GitHub repositories distributing Windows information stealers and GhostSocks, and macOS AMOS. GitHub removed the reported repositories; updated XProtect detects the analyzed macOS sample.
Key points
- Malicious GitHub repositories posing as OpenClaw installers were available from February 2 to 10, 2026; one was promoted as a top Bing AI result for “OpenClaw Windows.”
- Following the Windows installer instructions deployed information stealers and GhostSocks. Huntress identified a suspected new packer that injects payloads into memory, adds firewall rules, creates hidden scheduled tasks, and may check for mouse movement.
- GhostSocks turns compromised systems into proxies, allowing attackers to route traffic through victims’ networks and potentially evade anti-fraud checks when using stolen credentials.
- The macOS instructions downloaded a Mach-O binary assessed as an AMOS variant. It sought administrative credentials and permissions before collecting files from protected locations.
- Huntress reported the repositories, accounts, and organizations to GitHub, which took them down within eight hours. Updated XProtect rules detected the analyzed macOS file.
- The investigation also identified Vidar and suspected PureLogs payloads; the article provides hashes and other indicators for defenders.
Article Details
- Attack Vectors
- A Bing AI search result directed users searching for OpenClaw Windows to a fake installer hosted in a malicious GitHub repository.
- The fake Windows installer ran information stealers and GhostSocks on execution.
- The fake macOS installer used a bash one-liner to download and run an ad-hoc signed Mach-O binary.
- The macOS stealer requested administrator credentials and TCC permissions, then collected files from protected locations for exfiltration.
- Defensive Notes
- Do not assume software or releases hosted on GitHub are legitimate; verify that releases are actually associated with the repository’s code.
- Train users, including technically experienced users with administrator privileges, to assess installer sources and installation commands before running them.
- Apply current XProtect rules; Huntress reported that XProtect.yara version 5329 detects the analyzed OpenClawBot file.
- Huntress reported that GitHub removed the malicious repositories, accounts, and organizations within eight hours of the reports.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | serverconect[.]cc | C2 domain for the suspected PureLogs Stealer loader. |
| IPV4 | 121[.]127[.]33[.]212 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 144[.]31[.]123[.]157 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 144[.]31[.]139[.]201 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 144[.]31[.]139[.]203 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 144[.]31[.]204[.]136 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 144[.]31[.]204[.]145 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 147[.]45[.]197[.]92 | Primary GhostSocks helper address used for C2 over HTTPS. |
| IPV4 | 172[.]245[.]112[.]202 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 193[.]143[.]1[.]155 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 193[.]143[.]1[.]160 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 193[.]23[.]211[.]29 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 194[.]28[.]225[.]230 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 206[.]245[.]157[.]177 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 64[.]188[.]70[.]194 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 77[.]239[.]120[.]249 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 77[.]239[.]121[.]3 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 84[.]201[.]4[.]120 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 87[.]251[.]87[.]137 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 93[.]185[.]159[.]90 | Address identified in the article as a malicious GhostSocks helper C2 address. |
| IPV4 | 94[.]228[.]161[.]88 | Fallback GhostSocks helper address used for C2 over HTTPS. |
| SHA256 | 40fc240febf2441d58a7e2554e4590e172bfefd289a5d9fa6781de38e266b378 | Hash of svc_service.exe, a packed executable suspected of loading PureLogs Stealer. |
| SHA256 | 518ff5fbfa4296abf38dfc342107f70e1491a7460978da6315a75175fb70e2b3 | Hash of the main fake OpenClaw installer, reported as deploying information stealers. |
| SHA256 | a22ddb3083b62dae7f2c8e1e86548fc71b63b7652b556e50704b5c8908740ed5 | Hash of serverdrive.exe, identified as the GhostSocks backconnect proxy. |
| SHA256 | e13d9304f7ebdab13f6cb6fae3dff3a007c87fed59b0e06ebad3ecfebf18b9fd | Hash of OpenClawBot, identified as an AMOS-like macOS infostealer. |
| SHA256 | f03e38e1c39ac52179e43107cf7511b9407edf83c008562250f5f340523b4b51 | Hash of cloudvideo.exe, identified as a Vidar information-stealer payload. |
| SHA256 | fd67063ffb0bcde44dca5fea09cc0913150161d7cb13cffc2a001a0894f12690 | Hash of WinHealhCare.exe, identified as an information stealer with payload-decryption and Telegram data-sending capabilities. |
MITRE ATT&CK
T1005 · Data from Local SystemThe macOS infostealer searched Documents, Downloads, and Desktop for specified file types and collected files from those locations.T1027 · Obfuscated Files or InformationStealth Packer used decrypted payloads, and OpenClawBot decrypted actions at runtime.T1041 · Exfiltration Over C2 ChannelThe macOS stealer sent captured content in a POST request to the reported malicious upload URL.T1053.005 · Scheduled TaskThe activity created a hidden scheduled task configured to run daily.T1056.002 · GUI Input CaptureOpenClawBot requested administrator credentials and validated them with dscl before proceeding.T1059.004 · Unix ShellThe macOS installation instructions used a bash one-liner to download, modify permissions on, and run a Mach-O binary.T1071.001 · Web ProtocolsGhostSocks used TLS for C2 connections, and the macOS stealer exfiltrated data using an HTTP POST request.T1090.002 · External ProxyGhostSocks turned compromised systems into proxies so attackers could route activity through victims’ networks.T1105 · Ingress Tool TransferThe macOS launcher and Windows malware chain downloaded executables and additional payloads onto victim systems.T1204.002 · Malicious FileVictims downloaded and ran fake OpenClaw installer files from the malicious GitHub repositories.T1497.002 · User Activity Based ChecksStealth Packer debugging messages indicated potential checks for mouse movement before running decrypted payloads.T1547.001 · Registry Run Keys / Startup FolderGhostSocks set a Windows Run key to launch update.exe at user logon.T1560.001 · Archive via UtilityAfter collecting files, the macOS stealer used ditto to archive the cached data.T1608.006 · SEO PoisoningThe malicious GitHub repository was promoted into Bing AI search results for OpenClaw Windows, which the article describes as poisoned search results.
People
Threat Actors
Malware
Atomic macOS Stealer (AMOS)results and exploited the shared chat features of ChatGPT and Grok to trick users into downloading the AMOS stealer, whereas in this instance just hosting the malware on GitHub was enough to poison Bing AI searchGhostSocksHomeBlog“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information StealersPureLogs StealerThis was most prominent within a binary called svc_service.exe suspected to be a Rust-based malware loader that runs PureLogs Stealer in memory.Vidarcloudvideo.exe is a Vidar stealer payload that reaches out to both Telegram and Steam user profiles to retrieve dynamic C2 information based on the channel and user profile name.
Products
BingWhat made this successful was that the malware was hosted on GitHub, and the malicious repository became the top-rated suggestion in Bing’s AI search results for OpenClaw Windows.GitHubThis blog details an investigation into malicious GitHub repositories posing as OpenClaw installers that were available between the 2nd and 10th of February 2026.OpenClawHomeBlog“Malware, from the Outside!”: How a Threat Actor Used Fake OpenClaw Installers to Infect Systems with GhostSocks and Information StealersXProtectIt’s worth noting that in the hours after receiving the OpenClawBot for analysis, our researchers observed that the latest updates to XProtect.yara (version: 5329) detect this file under a new rule, MACOS.SOMA.CLBIFEA.