News

Security analysts have uncovered a deceptive npm module that pretends to be an OpenClaw installer but actually installs a remote access trojan and exfiltrates sensitive information from infected macOS systems.

The package, published under the name “@openclaw-ai/openclawai” by a user listing as “openclaw-ai” on March 3, 2026, has been downloaded 178 times so far and remained available in the registry at the time of reporting.

Researchers at JFrog, who flagged the package, say its capabilities include stealing system credentials, browser-stored data, cryptocurrency wallets, SSH keys, Apple Keychain databases and iMessage contents. The malicious payload also establishes a persistent RAT that supports remote control, a SOCKS5 proxy and live cloning of browser sessions.

JFrog’s analyst Meitar Palas noted the campaign’s wide-ranging data collection, the social-engineering techniques used to coax users into revealing their system password, and the advanced persistence and command-and-control design. Inside the malware, the operators refer to the codebase as “GhostLoader.”

The attack chain begins with a postinstall hook that forces a global reinstallation using the command “npm i -g @openclaw-ai/openclawai“. The package’s “package.json” sets the “bin” entry to “scripts/setup.js”, which causes that script to be exposed as a command-line executable on the victim’s PATH during installation.

That “scripts/setup.js” file functions as a first-stage dropper. When executed it renders a convincing fake CLI installer-complete with animated progress bars-to simulate a legitimate OpenClaw setup. After the bogus install completes, the script pops up a counterfeit iCloud Keychain authorization dialog asking the user to enter their macOS password.

Concurrently, the installer fetches an encrypted second-stage JavaScript payload from the attacker-controlled server at trackpipe.dev. The payload is decrypted, written to a temporary file, and launched as a detached background process; the temporary file is removed after around 60 seconds to help erase traces of the activity. If the script cannot access the Safari directory because Full Disk Access (FDA) is not granted, it displays an AppleScript dialog that walks the user through enabling FDA for Terminal and includes a button that opens System Preferences directly. Granting FDA allows the follow-on component to harvest Apple Notes, iMessage histories, Safari history and Mail data.

The second-stage JavaScript - roughly 11,700 lines long - is a comprehensive information-stealer and RAT framework. Its feature set includes persistence mechanisms, broad data collection, browser decryption routines, C2 communications, SOCKS5 proxying and a live browser-cloning capability. The malware is designed to extract a wide array of artifacts, including:

• macOS Keychain items (both the local login.keychain-db and any iCloud Keychain databases)
• Credentials, cookies, credit-card details and autofill entries from Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera, Yandex and Comet
• Data from desktop crypto wallets and browser extensions
• Seed phrases for cryptocurrency wallets
• SSH private keys
• Developer and cloud credentials for platforms and services including AWS, Microsoft Azure, Google Cloud, Kubernetes, Docker and GitHub
• Configurations for AI agents and related tooling
• And data guarded by Full Disk Access: Apple Notes, iMessage history, Safari browsing history, Mail account setups and Apple account information

Once information is collected, the malware compresses it into a tar.gz archive and exfiltrates the bundle via multiple routes: direct upload to the C2 server, the Telegram Bot API, and file-hosting services such as GoFile.io.

Beyond one-time data theft, the implant installs a persistent daemon that inspects the clipboard every three seconds. Any clipboard entry matching one of nine predefined patterns-private keys, WIF keys, SOL private keys, RSA private keys, Bitcoin addresses, Ethereum addresses, AWS keys, OpenAI keys and Strike keys-is immediately transmitted to the attackers. The agent also monitors running processes, scans live iMessage chats, and accepts commands from the C2 to run arbitrary shell commands, open URLs in the victim’s default browser, download or upload files, toggle a SOCKS5 proxy, enumerate available browsers, and manage browser cloning operations (start a headless clone with an existing profile or stop it). It can also self-delete or perform an update on command.

The browser-cloning feature is particularly alarming: it spins up a headless Chromium instance that loads an existing user profile containing cookies, saved logins and history, effectively giving an attacker a fully authenticated browsing session without needing to extract credentials directly.

The “@openclaw-ai/openclawai” package bundles social-engineering tricks, encrypted payload delivery, extensive data harvesting and a persistent RAT into a single npm module. The realistic fake CLI installer and the convincing Keychain prompt are capable of tricking even cautious developers into divulging their system password, which in turn unlocks Keychain contents and enables browser credential extraction that macOS protections would otherwise prevent.