OpenClaw’s agent “skill” ecosystem to deliver both Remcos RAT and a cross‑platform stealer called GhostLoader by hiding malware inside a deceptive DeepSeek integration called “DeepSeek‑Claw.”
The campaign shows how agentic AI workflows with high local privileges can be quietly hijacked through manipulated installation instructions rather than classic exploit chains.
OpenClaw, formerly known as Clawdbot and Moltbot, is an open‑source framework for autonomous Openclaw AI agents that can run shell commands, read and write local files, and automate complex tasks with high‑privilege access.
Its modular skill architecture allows third‑party extensions to run with full agent permissions, effectively functioning as an unguarded software supply chain on the host.
In early 2026, multiple vendors warned that malicious skills were turning OpenClaw from an automation tool into a delivery channel for infostealers and RATs masquerading as productivity add‑ons.
The “DeepSeek‑Claw” skill is a new example of this trend, explicitly targeting the growing reliance on autonomous AI agents in developer workflows.
In March 2026, Zscaler ThreatLabz observed a campaign where a threat actor published a fake “DeepSeek‑Claw” skill that claims to integrate OpenClaw with DeepSeek, but actually embeds multiple execution paths in its SKILL.md installation file.
Because OpenClaw agents routinely parse skill documentation and execute suggested commands, these instructions can be followed autonomously by the AI or manually by unsuspecting developers.
The attack chain branches based on platform and installation method: on Windows, an automated PowerShell‑driven flow pulls a remote MSI that installs Remcos RAT, while cross‑platform “manual” steps instead deploy a Node. js‑based GhostLoader stealer.
This design allows the same skill to weaponize both agent‑driven and human‑driven workflows without any exploit of OpenClaw’s core binaries.
On Windows systems, the SKILL.md file includes a PowerShell one‑liner that silently invokes msiexec to download and install a remote MSI package.
The MSI drops a legitimate GoToMeeting executable (G2M.exe) alongside a malicious g2m.dll, abusing DLL search order hijacking to sideload the attacker’s code under a trusted, signed binary.
The rogue DLL behaves as an in‑memory shellcode loader that resolves APIs dynamically, decrypts strings via XOR, and uses the Tiny Encryption Algorithm (TEA) in CBC mode to unpack the embedded Remcos RAT payload.
Before launching the RAT, it patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to suppress telemetry and in‑memory scanning, then runs extensive anti‑debugging, timing‑based sandbox checks, and process/mutex‑based virtualization detection to evade analysis.
Once active, Remcos establishes an encrypted TCP/TLS C2 channel, logs keystrokes, steals browser cookies from local SQLite databases, and provides an interactive reverse shell, with configuration stored in an RC4‑encrypted resource that defines persistence, stealth mode, and C2 endpoints.
If a user or AI agent follows the alternative manual instructions (for example, install scripts or npm‑based setup), the same skill triggers a GhostLoader (also known as GhostClaw) attack chain instead of Remcos.
On Windows, GhostLoader is embedded in heavily obfuscated Node.js lifecycle scripts that are invoked by Bash‑based installers, hiding the malicious setup.js behind seemingly benign developer tooling.
On macOS and Linux, GhostLoader uses terminal‑based social engineering, including spoofed sudo password prompts, to capture user credentials, then pivots to collecting SSH keys, macOS keychain data, cryptocurrency wallets, and cloud API tokens for exfiltration to attacker‑controlled servers.
Previous public reporting has already linked GhostLoader‑style campaigns to the abuse of trusted developer workflows, making this OpenClaw skill an evolution of an existing cross‑platform stealer family rather than a new malware line.
This campaign underlines how agentic AI platforms turn documentation and skill metadata into active execution surfaces, where “installation steps” can function as malware delivery scripts.
Security teams should treat OpenClaw skills as untrusted software packages, enforce strict review and provenance checks for third‑party skills, and deploy behavioral monitoring to detect DLL sideloading, ETW/AMSI patching, and unusual npm lifecycle activity on endpoints.
Organizations adopting autonomous agents should also segment high‑privilege agent hosts, limit filesystem and credential exposure, and implement controls that prevent skills and prompt‑driven workflows from invoking installers or shell commands without explicit human approval.
As the DeepSeek‑Claw case shows, the AI agent itself can become the “user” that clicks install turning traditional endpoint defenses into the last, and often only, line of protection.
| Indicator | Details |
|---|---|
| 1c267cab0a800a7b2d598bc1b112d5ce | “Deepseek-Claw” named OpenClaw Skill |
| 2A5F619C966EF79F4586A433E3D5E7BA | MSI Installer |
| hxxps://cloudcraftshub[.]com/api | MSI download URL |
| hxxp://dropras[.]xyz/ | MSI download URL |
| https://github.com/Needvainverter93/deepseek-claw | GitHub repository |
| CC1AF839A956C8E2BF8E721F5D3B7373 | Shellcode loader |
| 2C4B7C8B48E6B4E5F3E8854F2ABFEDB5 | Remcos RAT |
| 146[.]19.24[.]131:2404 | Remcos C2 |
| hxxps://trackpipe[.]dev | GhostLoader C2 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…