Malware GhostClaw steals developer cryptocurrency wallet data by impersonating the legitimate OpenClaw CLI tool

Techub News reports, according to CryptoPolitan, a new malware named GhostClaw is targeting cryptocurrency wallets on macOS devices. This malware, disguised as a legitimate OpenClaw CLI tool, remained in the NPM registry for a week, infected 178 developers, and was removed on March 10. Once a developer runs the "npm install" command, a hidden script globally installs the GhostClaw package and evades detection through an obfuscated configuration file. GhostClaw scans the clipboard every three seconds, capturing cryptocurrency wallet and transaction-related data such as private keys, mnemonic phrases, and public keys. After the second-stage payload is downloaded, GhostLoader scans for cryptocurrency wallet data in Chromium browsers, the macOS Keychain, and system storage, clones browser sessions to gain access to logged-in wallets, and steals API Tokens connected to AI platforms like OpenAI and Anthropic. The stolen data is sent to the attackers via Telegram, GoFile, and command servers.