Frequency
4
occurrences
First Seen
March 10, 2026
Last Seen
March 20, 2026
Related Threat Clusters
-
Malicious npm Package Disguises as OpenClaw to Deploy GhostClaw RAT
A rogue npm package named '@openclaw-ai/openclawai' has been identified as a malicious installer for a remote access trojan (RAT) known as GhostClaw. This malware targets software developers, stealing sensitive…
15 articles · Updated March 10, 2026
Recent Intelligence Reports
- GhostClaw expands beyond npm: GitHub repositories and AI workflows deliver macOS infostealer — Mactech · March 20, 2026
- Cybersecurity researchers uncover GhostLoader malware hidden in fake OpenClaw npm package — Mexc · March 11, 2026
- GhostLoader Malware Spreads Through Fake OpenClaw npm Package — Socradar · March 10, 2026
- Devs looking for OpenClaw get served a GhostClaw RAT — Csoonline · March 10, 2026