Malicious OpenClaw installer spreads malware through Bing AI search suggestions

According to cybersecurity researchers, users who searched for “OpenClaw Windows” on Bing were shown a GitHub repository link within AI-generated search suggestions. The repository appeared genuine but was actually malicious. Anyone who downloaded and ran the installer unknowingly infected their computer with multiple types of malware. Investigations revealed that the fake repository remained active on GitHub from February 2 to February 10, during which several users downloaded the installer believing it to be legitimate. The issue surfaced after researchers noticed suspicious activity linked to the installer and began examining the files shared through the repository.

Experts said the scam worked mainly due to 2 reasons. First, the malware was hosted on GitHub, a widely trusted platform for open-source projects. Since the real OpenClaw project already has thousands of forks on GitHub, users were more likely to assume the repository hosting the installer was authentic. The second factor was the credibility added by Bing’s AI search results. By uploading the malicious repository and manipulating search visibility, attackers managed to push the fake download link as the top suggestion when users searched for “OpenClaw Windows,” making many believe it was the official download source.

Security researchers identified the threat on February 9 after a user downloaded and executed the installer. Further analysis showed that the file triggered the installation of multiple data-stealing programs once run. Much of the visible code in the repository was copied from a legitimate open-source project, which helped it appear authentic. However, a hidden executable named OpenClaw_x64.exe was placed inside a compressed 7-Zip archive in the “releases” section. Once executed, it deployed several malicious components including Vidar Stealer, which can steal credentials and account data from services such as Telegram and Steam, along with other stored information. Another malware called GhostSocks converted infected systems into residential proxy nodes, allowing criminals to route malicious traffic, hide their location, and access stolen accounts without triggering fraud detection systems.

Researchers also found that attackers used a previously unseen tool called Stealth Packer to hide the malware and avoid detection. This tool performed several stealth actions on infected systems, including creating hidden scheduled tasks, modifying firewall rules, and checking whether the malware was running inside a virtual machine before activating the payload. After the incident was reported, GitHub removed the malicious repository and related accounts. However, researchers warned that multiple similar accounts and organisations had been created to distribute comparable malware, indicating the campaign could be larger than initially believed. Cybersecurity experts said the incident highlights how quickly attackers exploit trending technologies. They advise users to download software only from official sources, verify repository authenticity, run new AI tools in isolated environments, restrict access to sensitive data, and avoid granting high-level system permissions to reduce the risk of malware infections.