Malware GhostClaw steals developer encrypted wallet data through npm package

According to market news, a new piece of malware called GhostClaw is targeting encrypted wallets on macOS devices. The malware, disguised as a legitimate OpenClawCLI tool, stayed in the npm registry for a week, infected 178 developers before being removed. Once the developer runs the "npminstall" command, the hidden script installs the GhostClaw package globally and escapes detection through obfuscated settings files. GhostClaw scans the clipboard every three seconds to capture encrypted wallet and transaction-related data such as private keys, mnemonics, and public keys. After the second phase of payload download, GhostLoader scans encrypted wallet data in the Chromium browser, macOS keychain, and system storage, clones browser sessions to gain access to logged in wallets, and steals APITokens connected to AI platforms such as OpenAI and Anthropic. The stolen data is sent to attackers through Telegram, GoFile and command servers.