How Fake OpenClaw Installers Spread GhostSocks Malware

What it is

A February 2026 Huntress investigation into malicious GitHub repositories impersonating OpenClaw installers, live between Feb 2–10, 2026. OpenClaw is a popular open-source AI assistant (formerly Clawdbot, briefly Moltbot) with hundreds of thousands of GitHub stars. The fake repos delivered information stealers plus GhostSocks on Windows, and Atomic macOS Stealer (AMOS) on macOS. The stealers were wrapped in a novel packer Huntress calls Stealth Packer.

How it works

The attack turns on search-result poisoning rather than a software vulnerability. A newly created GitHub org named openclaw-installer hosted the repo, lending it inherent trust. Simply hosting on GitHub was enough to make it the top Bing AI search suggestion for "OpenClaw Windows" — Bing's AI natively recommended it. This differs from a December campaign Huntress observed, which required abusing ChatGPT/Grok shared-chat features to push the AMOS stealer.

Following the repo's install instructions runs the payloads. The macOS path is a bash one-liner (the tell that flags it as malicious to a human). Stealth Packer injects malware into memory, adds firewall rules, creates hidden "ghost" scheduled tasks, and does mouse-movement AntiVM checks before decrypting payloads.

GhostSocks — previously used by the BlackBasta ransomware group — converts the victim into a proxy, routing attacker traffic through the victim's own system to defeat anti-fraud and MFA checks on logins using stolen credentials.

flowchart TD
    A[User searches Bing AI: OpenClaw Windows] --> B[Malicious GitHub repo = top result]
    B --> C{OS}
    C -->|Windows| D[Infostealer + GhostSocks]
    C -->|macOS| E[AMOS via bash one-liner]
    D --> F[Stealth Packer: memory inject, firewall rules, ghost tasks]
    D --> G[GhostSocks proxy → bypass MFA/anti-fraud]

Preconditions / Affected

Any Windows or macOS user seeking OpenClaw who trusted an AI search suggestion and manually ran the installer/command. No industry targeting — broad. Note the compounding risk: even a legitimate OpenClaw install stores passwords, API keys and other secrets in config files that a stealer harvests (per Hudson Rock).

What to do

The page states no patch or command-level remediation. The actionable guidance is behavioral:

• Do not trust that a GitHub repo's releases correspond to the code shown, or that hosting on a trusted platform (or an AI recommendation) implies safety.
• Verify the actual upstream OpenClaw project rather than following AI-surfaced install links.
• Treat AI search results (Bing, ChatGPT, Grok) as a poisoning vector — attackers now target the AI recommendation layer directly.
• Detection hunting hints from Stealth Packer behavior: unexpected firewall rule additions and hidden/ghost scheduled tasks.

Caveats

No IOCs, hashes, or the specific repo/one-liner are reproduced in this excerpt (truncated mid-analysis). The offending repo was taken down after Huntress reported it and GitHub responded. "Stealth Packer" is Huntress's own naming for a newly observed packer.