14 Oct 2026 · Solene Beaumont-Adjei (editorial persona) · Incident response · on threat.cafe

Fake OpenClaw installers ranked by AI search: a postmortem and a five-minute check for new agent tools

Before you run an installer for a new agent tool, check five things: the download appears on the project's own official channel, the publisher account has a real history, the release files match the source code, the install steps contain no red flags, and the approval is written down. In February 2026 a developer who searched Bing for "OpenClaw Windows" was sent by its AI search suggestion to a fake GitHub installer that dropped infostealers. Each of the five checks would have caught it, and the whole routine takes about five minutes.

Cold open: Monday, 9 February 2026

On Monday, 9 February 2026, Huntress was alerted to an infected Windows machine. The user had wanted OpenClaw, the open-source personal AI assistant. They searched Bing for "OpenClaw Windows." Bing's AI search suggestion linked to a GitHub repository called openclaw-installer. According to Huntress's write-up, it was the top-rated suggestion for that query.

The user opened the repository's Releases section, downloaded a 7-Zip archive, and ran OpenClaw_x64.exe from inside it.

Nothing about the page looked wrong. It sat on GitHub, under a name that matched the product, and a search engine had recommended it.

What made the lure believable

Three things gave the fake repository credibility, and none of them was a security signal.

The host. Huntress notes that hosting the malware on GitHub was enough to get it into Bing's AI results. No chatbot share-link abuse was needed.

The source code. The repository's code was "largely just legitimate code," taken from Cloudflare's moltworker project. A reviewer skimming the files saw ordinary code. The malware was in the Releases section, in executables that had no connection to that code.

The timing. OpenClaw had been renamed twice in about three months. It launched as Clawdbot in November 2025, became Moltbot in late January 2026, and became OpenClaw three days later. A project that changes names that often leaves users unsure what the official download looks like.

The stakes were higher than one infected laptop. Huntress points out that OpenClaw configuration files hold "an array of sensitive information, including passwords, API keys, and more." The people installing a tool like this are usually technical users, and they often have admin rights. A stealer on that machine collects the keys an agent uses.

How the campaign was set up

The accounts were not new when the attack started. Huntress reconstructed this timeline:

September 2025. The threat actor's GitHub accounts were created. They showed no public activity for months.
24 December 2025. A related repository, ComfyUI-easy, was created as a fake ComfyUI installer.
30 January 2026. The main account opened issues on the official OpenClaw repository promoting a different repository. Maintainers closed them as spam.
2 February 2026. The fake installers went live. A second account hosted the macOS payload in a repository called dmg under the organisation puppeteerrr.
4 February 2026. A fake SimpleClaw installer repository appeared.
9 February 2026. Huntress was alerted to the infected Windows machine.
Within eight hours of Huntress's report. GitHub removed the repositories, accounts and organisations.
11 February 2026. A copy, openclaw-installer under the organisation install-openclaw, appeared a day after the takedown.

The account also borrowed a profile picture from an X account with nearly 200,000 followers, Huntress reports. Dormant accounts, a borrowed face and spam in the real project's issue tracker were all visible before the first victim ran anything.

What ran on each operating system

The Windows file was a bloated binary originally named TradeAI.exe and described as an "Automatic hardware driver update tool." It started several Rust-based loaders. Huntress names three payloads: Vidar, a stealer that fetched its command-and-control address from a Telegram channel and a Steam profile; a loader for PureLogs Stealer, wrapped in a packer Huntress calls Stealth Packer; and GhostSocks, a proxy that turns the infected machine into a relay. Persistence came through a Run key and a scheduled task named EdgeUpdateHelper.

macOS users were told to paste a one-line command into Terminal. It downloaded an ad-hoc signed binary called OpenClawBot, which Huntress identifies as a variant of Atomic macOS Stealer. It asked for an administrator password, requested privacy permissions, and searched Documents, Downloads and Desktop for files such as .env and .json. Apple's XProtect added a detection rule for it, so up-to-date Macs now block it.

Huntress's response was standard: isolate the machine, report the content to GitHub, and keep watching. GitHub acted within eight hours. The replacement copy appeared a day later.

The pattern behind it

The campaign worked because three signals that teams use as shortcuts for trust were all present at once:

a high rank in search
hosting on a reputable platform
readable source code

None of them says who built the file you are about to run. Huntress's own advice was to "verify that GitHub releases match the repository's code" and not to assume software is safe because of where it is hosted.

The broader context makes this routine worth adopting now. Verizon's 2026 Data Breach Investigations Report says frequent employee use of AI tools rose from 15% to 45% in a single year, based on 2025 data. More people are installing AI tools themselves, and the first stop is often a search box.

The five-minute routine

Run this before anyone installs a new agent tool, a desktop assistant or a companion CLI. Each step has a stop condition. One stop is enough to halt the install.

NEW AGENT TOOL: FIVE-MINUTE CHECK
---------------------------------------------------------------
1  Official channel     Find the install method on the project's
   (about 1 min)        own README or website, reached by typing
                        the address or from the project's main
                        repository, not from a search result.
                        STOP if your download is not listed there.

2  Publisher history    Check when the account or organisation
   (about 1 min)        was created and what it has done since.
                        gh api users/OWNER --jq '.created_at'
                        STOP if it is new, or was dormant for
                        months and then suddenly active.

3  Release vs source    Does a build workflow in the repository
   (about 1 min)        produce the release file? If the project
                        publishes attestations, verify them:
                        gh attestation verify FILE -R OWNER/REPO
                        STOP if the release has no visible link
                        to the code.

4  Install red flags    A driver tool inside a product installer,
   (about 1 min)        an archive holding an .exe, a paste-into-
                        Terminal command from an unofficial
                        domain, an admin password prompt.
                        STOP on any of these.

5  Record it            Tool, source URL, version, SHA-256 of
   (about 1 min)        the file, who approved, date.
                        shasum -a 256 FILE
---------------------------------------------------------------

Applying it to the OpenClaw case

Step 1 alone would have stopped this install. The official OpenClaw README, read on 15 October 2026, lists install scripts hosted on the openclaw.ai domain, an npm package, and further options in the project's documentation. It does not mention a Windows .exe installer. A download called OpenClaw_x64.exe from a different GitHub organisation fails the check before anything else is looked at.

Step 2 would have found accounts created in September 2025 that sat silent until the campaign. Step 3 would have found Releases with no connection to the repository's moltworker code. Step 4 would have flagged a "hardware driver update tool" and, on macOS, a Terminal one-liner followed by an administrator password prompt.

What step 3 does and does not prove

GitHub's artifact attestation documentation describes attestations as a way to establish "where and how your software was built." A passing gh attestation verify check ties a file to a build in the repository you named. It does not say the code in that repository is benign, and many legitimate projects publish no attestations at all. A missing attestation is a prompt to look at the build workflow, not proof of malice. A passing one on the wrong repository proves nothing useful, which is why step 1 comes first.

Package managers and install scripts

Package managers and install scripts are channels too. The same test applies: the entry you install should be the one the project's own README names. A copy-and-paste script from the official domain is still a script you are trusting. Read it before running it, and record which version you ran.

Making it team policy

A routine only works if it runs before the install, not after. Four rules turn the card into policy:

New tool, new check. Any agent tool not already on the approved list goes through the five steps before first install, whoever is installing it.
One source of truth. Keep the approved tools, their official URLs and the recorded hashes in one shared place. The second person to install the tool uses that link, not a search engine.
Search results are not a source. That includes AI search answers. They can be the starting point for finding the project, never the download link.
Admin prompts get a second look. If an installer asks for an administrator password the official documentation does not mention, stop and ask.

Limits of this postmortem

This is one campaign, documented by the firm that found it. The routine is built from that case and has been applied here only to OpenClaw. AI search ranking changes often, and a later lure may sit on a channel this card does not name. The checks still apply, because they test the file and its publisher, not the search engine.

The threat.cafe board tracks this campaign alongside other agent lures, with the finder credited on each entry.

Sources

#openclaw #fake-installers #ai-search #github-releases #onboarding

All posts