- Pro
- Security
OpenClaw's popularity is proving a great vessel for malware distribution
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
(Image credit: Fortune)
- Copy link
- X
- Threads
Sign up for breaking news, reviews, opinion, top tech deals, and more.
Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.You are now subscribed
Your newsletter sign-up was successful
An account already exists for this email address, please log in. Subscribe to our newsletter- Cybercriminals exploit OpenClaw’s popularity with fake variants
- Malicious GitHub repos deliver Vidar and GhostSocks malware
- Malvertising campaigns spread tainted installers via Bing
Whenever a new trendy app or software emerges, cybercriminals try to capitalize on it by smuggling tainted, or outright fake, variants. We’ve seen it numerous times before, for example when ChatGPT first came out.
Now, we’re seeing the same with OpenClaw, the open source AI agent platform which grew immensely popular due to its ability to run tasks directly on a computer, such as reading files, sending messages, or running commands. It is currently one of the most popular AI projects, with more than 100,000 stars on GitHub.
However, there are also fake variants on GitHub that deploy various malware families to the victims - and in a new report, security researchers Huntress said the primary payload is Vidar, an infostealer that collects sensitive data such as credentials and user information from apps like Telegram. It is being dropped through loaders that execute the stealer directly in memory.
You may like-
Moltbot is now OpenClaw - but watch out, malicious 'skills' are still trying to trick victims into spreading malware
-
OpenClaw AI agents targeted by infostealer malware for the first time
-
Fake Moltbot AI assistant just spreads malware - so AI fans, watch out for scams
Malvertising on Bing
The loaders also sometimes deploy GhostSocks, a proxy malware that turns infected machines into residential proxies. Criminals use these proxies to route malicious traffic, often selling it as a service.
According to Huntress, these fakes were added to GitHub on February 2, and remained there until February 10, when they were spotted and removed.
Being hosted on GitHub was dangerous enough, since the platform is regarded as trustworthy and millions of people use it every day (despite it often being used as a launchpad for malware distribution). Making matters worse was a malvertising campaign on Bing.
The researchers said they spotted the attack when a user downloaded and ran the fake installer. "Analysis revealed that this user had searched for the term OpenClaw Windows through Bing and had the AI suggestion link directly to a newly created malicious GitHub repository openclaw-installer," they explained.
Are you a pro? Subscribe to our newsletterContact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.Whenever a new popular app comes along, cybercriminals start advertising fake variants on popular networks. Sometimes they’ll advertise a non-existent premium version, and sometimes a version for an unsupported platform.
The best antivirus for all budgetsOur top picks, based on real-world testing and comparisons➡️ Read our full guide to the best antivirus1. Best overall:Bitdefender Total Security2. Best for families:Norton 360 with LifeLock3. Best for mobile:McAfee Mobile Security
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.
TOPICS Bing Malware Sead FadilpašićSocial Links NavigationSead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
View MoreYou must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
Logout Read more
Moltbot is now OpenClaw - but watch out, malicious 'skills' are still trying to trick victims into spreading malware
OpenClaw AI agents targeted by infostealer malware for the first time
Fake Moltbot AI assistant just spreads malware - so AI fans, watch out for scams
Dangerous WebRAT malware now being spread by GitHub repositories
Microsoft says OpenClaw is "not appropriate to run on a standard personal or enterprise workstation" — so should you be worried?
'A human-chosen password doesn't stand a chance': OpenClaw has yet another major security flaw — here's what we know about "ClawJacked"
Latest in Security
Microsoft warns of new signed malware which deploys remote monitoring tools as backdoors
Chinese hackers hide malware within Windows and Google Drive to hit government targets
Major data leak forum LeakBase seized by FBI, Europol, and shut down
Microsoft, Europol take down global phishing as a service network which was able to bypass 2FA with ease
'The total industrialization of cyber threats': Cloudflare report outlines how hackers are 'weaponizing the Internet'
iPhones targeted by 'new and powerful' malware - and "Coruna" may have been developed by the US government
Latest in News
OpenAI introduces ChatGPT 5.4 Thinking for solving bigger problems
AdGuard enters the metaverse: VPN and ad-blocker extensions launch on Meta Quest
Staff are seeing a lot more from our smart glasses than we might want
‘F1.4 would be wild’ — Canon tipped to launch a game changing zoom lens in 2026
The rare Nintendo PlayStation hardware prototype that was never released has been acquired by The National Videogame Museum
'A liability trap' — NordVPN slams Utah age verification law targeting VPN users
LATEST ARTICLES- 1Hackers exploit OpenClaw to spread malware via GitHub - and a little help from Bing
- 2OpenAI introduces ChatGPT 5.4 Thinking for solving bigger problems
- 3‘F1.4 would be wild’ — Canon tipped to launch a game changing zoom lens in 2026
- 4'Straight up lies': Anthropic CEO attacks OpenAI's US military deal
- 5Staff are seeing a lot more from our smart glasses than we might want