As open-source AI agent project OpenClaw has surpassed 320,000 stars on GitHub and risen to the top ten repositories worldwide, hackers are eyeing this lucrative target. Security firm OX Security has reported recent large-scale phishing campaigns targeting developers, where hackers use GitHub’s tagging feature to spread false messages about “claiming $5,000 CLAW tokens,” tricking users into clicking links and draining their crypto wallets.
(Background: Full transcript of Jensen Huang’s GTC 2026 speech: AI demand reaches trillions of dollars, computing power jumps 350 times, OpenClaw turns every company into AaaS)
(Additional context: China’s Ministry of State Security warns of “Lobster Farming”: OpenClaw contains four major security mines, your device could be compromised)
Table of Contents
Toggle
- GitHub “Tagging” Feature Hijacked by Malicious Actors
- “Pixel-perfect” Website Cloning Hidden Wallet Drainers
- Founder Urgently Clarifies: No Token Promotions for OpenClaw
- Multiple Attack Vectors: Fake Installers and Malicious Plugins
Amid the wave of AI Agents, popular open-source projects are becoming new battlegrounds for targeted hacker attacks. According to a security alert issued by OX Security on March 18, a “wallet draining” operation targeting OpenClaw supporters is currently underway.
GitHub “Tagging” Feature Hijacked by Malicious Actors
This attack has caught many veteran developers off guard due to its use of “living-off-the-land” social engineering tactics. Hackers leverage the GitHub API to filter high-value targets who have starred (liked) the OpenClaw project, then open discussion threads in malicious repositories and simultaneously tag dozens of developers.
Since these notifications come from GitHub’s official email address ([email protected]), they are highly convincing. The attackers claim that the recipient has been selected to receive a $5,000 “CLAW” token reward, luring victims to phishing sites.
“Pixel-perfect” Website Cloning Hidden Wallet Drainers
According to OX Security’s technical analysis, hackers have set up malicious domains like token-claw[.]xyz, which nearly perfectly replicate the official OpenClaw website (openclaw.ai). However, these phishing sites include a critical “Connect your wallet” button.
Once clicked, a hidden “Wallet Drainer” script activates, supporting popular wallets like MetaMask and WalletConnect. The obfuscation script eleven.js communicates with the C2 server watery-compost[.]today, and after user authorization, instantly transfers all assets from the account.
Founder Urgently Clarifies: No Token Promotions for OpenClaw
In response to this aggressive attack, OpenClaw founder Peter Steinberger issued a stern warning on X (formerly Twitter):
“Everyone, if you receive emails or visit websites claiming to be related to OpenClaw and offering tokens, it’s definitely a scam. OpenClaw is a non-profit project, and we will never run such promotions.”
Folks, if you get crypto emails from websites claiming to be associated with openclaw, it’s ALWAYS a scam.
We would never do that. The project is open source and non-commercial. Use the official website. Be sceptical of folks trying to build commercial wrappers on top of it.
— Peter Steinberger 🦞 (@steipete) March 18, 2026
Multiple Attack Vectors: Fake Installers and Malicious Plugins
In fact, the security threat to OpenClaw extends beyond this. Earlier this month, cybersecurity researchers uncovered additional risks:
- Fake Installers: Malicious repositories leverage Bing AI search result rankings to distribute fake OpenClaw installers embedded with Vidar info-stealing trojans.
- NPM Supply Chain Attacks: Hackers released malicious packages like @openclaw-ai/openclawai, which deploy GhostLoader remote access trojans upon installation.
- ClawHub Malicious Plugins: In the “Skills” store designed for OpenClaw, up to 12% of plugins were found to contain AMOS info-stealing malware.
Currently, OpenClaw ranks ninth globally in popularity on GitHub. Security experts urge all developers to avoid testing unknown AI plugins on machines containing enterprise credentials or large digital asset stores, and to reject any “blind signature” authorization requests.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Russian Crypto Exchange Grinex Halts Operations After $13M Hack, Threatening Sanctions Evasion Network
Russian cryptocurrency exchange Grinex ceased operations after a cyberattack caused losses over $13 million. The shutdown impacts Russian businesses' ability to convert rubles internationally and challenges the country's shadow finance system.
GateNews2h ago
Kelp DAO Hack Attributed to Lazarus Group; eth.limo Domain Hijacked via Social Engineering
LayerZero reported that the Kelp DAO exploit, attributed to North Korea's Lazarus Group, led to a loss of $292 million in rsETH tokens due to vulnerabilities in its decentralized verifier network. Additionally, eth.limo faced a domain hijacking from a social engineering attack, but DNSSEC mitigated severe damage.
GateNews6h ago
DeFi Hack Triggers $9 Billion in Outflows from Aave as Stolen Tokens Used as Collateral
A recent hack draining nearly $300 million from a crypto project led to a liquidity crisis on Aave, causing users to withdraw around $9 billion. Concerns over collateral quality prompted mass withdrawals, highlighting risks in DeFi lending.
GateNews6h ago
Ethereum Phishing Attack Drains $585K From Four Users, Single Victim Loses $221K WBTC
A coordinated Ethereum phishing attack drained $585,000 from four victims, exploiting user permissions through a deceptive link. This incident highlights the rapid loss of funds via social engineering, even under the guise of legitimacy.
GateNews8h ago
Pay attention to the signed content! Vercel is hit with ransomware demanding $2 million, and crypto protocol frontend security raises a red flag
The cloud development platform Vercel was breached by hackers on April 19. The attackers gained access through a third-party AI tool used by employees and threatened to extort $2 million. Although sensitive data was not accessed, other data may have been used. The incident has raised security concerns in the crypto community, and Vercel is currently investigating while advising users to rotate their keys.
ChainNewsAbmedia10h ago
KelpDAO Loses $290M in Lazarus Group LayerZero Attack
KelpDAO faced a $290 million loss due to a sophisticated security breach linked to the Lazarus Group. The attack exploited configuration weaknesses in their verification system and highlighted the risks of relying on a single-point verification setup. Industry experts emphasize the need for improved security configurations and multi-layer verification to prevent future incidents.
CryptoFrontier10h ago
