GhostClaw Malware Targets Developers to Steal Crypto Wallet Credentials
A malicious npm package dubbed GhostClaw infiltrated 178 developers' systems before being removed from the registry. The malware, posing as the OpenClaw CLI tool, executed a multi-stage attack to extract sensitive data including crypto wallet keys, macOS Keychain passwords, and cloud credentials.
The attack vector relied on developers running 'npm install,' triggering a hidden script that installed the malware globally. GhostClaw's clipboard monitoring feature scanned for crypto-related data every three seconds—capturing private keys, seed phrases, and transaction details with surgical precision.
After harvesting credentials, the malware downloaded a secondary payload called GhostLoader from a remote server. This advanced module functioned as both a data exfiltrator and remote access trojan, compromising developers' access to cloud platforms, code repositories, and digital assets.
