OpenClaw Trap: AI-Assisted Lure Factory Targets Developers & Gamers

Keypoints

• Over 300 delivery packages across multiple GitHub repositories use a trojanized distribution that impersonates legitimate projects (notably an OpenClaw Docker deployer) to deliver malicious payloads.
• The malware uses a deliberate two‑component design: a renamed LuaJIT runtime (e.g., unc.exe) plus an encrypted/obfuscated Lua script (license.txt) that appear benign when analyzed separately, defeating standard file/single‑artifact sandboxing.
• The payload performs five anti‑analysis checks (debugger presence, low RAM, short uptime, SeDebugPrivilege enumeration, computer name) and then calls Sleep(922,337,203,695,477 ms) to evade timed sandboxes before continuing execution under instrumentation.
• On execution the payload disables WinINet proxy auto‑detection to bypass inspection, performs geolocation to ip‑api.com, captures a full desktop BMP screenshot, and uploads it via multipart/form POST to a Frankfurt IP; the C2 responds with encrypted task and loader blobs saved to Documents.
• Static and dynamic analysis shows the same Prometheus‑obfuscated LuaJIT toolchain and identical inner payloads across gaming cheats, developer tools, phone‑tracker lures, Roblox scripts, crypto bots, and VPN crackers—indicating a single, scalable “lure factory” likely using AI to generate lure names and directories.
• Netskope ATP detected the threat via behavioral heuristics, the operator infrastructure (multiple Frankfurt IPs and identical C2 responses) was reported to GitHub, and published IOCs (hashes, IPs, repos, TLSH, Telegram) are available for deployment in EDR/network tooling.