Cybersecurity researchers have uncovered a campaign where fake installers for OpenClaw were distributed through GitHub repositories and surfaced via Microsoft Bing’s AI-powered search results, ultimately infecting users with information-stealing and proxy malware.
OpenClaw, a widely used open-source AI assistant, is designed to perform tasks with access to local files and integrations across email, messaging platforms, and other online services. Its extensive permissions made it an attractive target for cybercriminals aiming to extract sensitive user data.
Threat actors leveraged this by uploading malicious instruction files and fake installers to GitHub, including listings that appeared in the tool’s official registry. The activity was identified last month by researchers at Huntress, a managed detection and response firm, who observed multiple malware variants being distributed to users attempting to install OpenClaw.
According to Huntress, attackers created deceptive GitHub repositories posing as legitimate OpenClaw installers. These repositories were even recommended in Bing’s AI-generated search results for the Windows version of the software, increasing their visibility and credibility.
The researchers noted that "just hosting the malware on GitHub was enough to poison Bing AI search results."
One such repository analyzed by Huntress looked convincing at first glance, as it was linked to a GitHub organization named “openclaw-installer,” which may have influenced Bing’s AI recommendations. Although the GitHub accounts behind these repositories were newly created, the attackers attempted to appear legitimate by copying code from the Cloudflare moltworker project.
For macOS users, the fake repository included installation instructions directing users to execute a bash command in Terminal. This command connected to another GitHub organization called “puppeteerrr” and a repository named “dmg,” which hosted malicious payloads.
"The repository contained a number of files that followed a theme of containing a shell script paired with a Mach-O executable,"
Huntress researchers identified this payload as Atomic Stealer malware.
Windows users were targeted through a fake installer named OpenClaw_x64.exe, which deployed several harmful executables. In one analyzed case, security tools such as Managed AV and Defender for Endpoint successfully quarantined the files before further damage occurred.
Most of the payloads were written in Rust and functioned as loaders to run information stealers directly in memory. Among them was the Vidar stealer, which retrieved command-and-control instructions via Telegram and Steam profiles.
Another payload delivered through the campaign was GhostSocks, a backconnect proxy malware that converts infected machines into proxy nodes. Such compromised systems can be used to access stolen accounts, bypass fraud detection systems, route malicious traffic, or conceal attacker activity.
During the investigation, Huntress uncovered multiple GitHub accounts and repositories linked to this campaign, all targeting individuals searching for OpenClaw installation files.
Although the malicious repositories have been reported to GitHub, it remains uncertain whether all of them have been removed.
Users are advised to rely on official sources when downloading software and to bookmark trusted websites instead of repeatedly searching for them online.
