OpenClaw Skill Distributes Remcos & GhostLoader | ThreatLabz
Threat actors are exploiting the OpenClaw AI agent framework by publishing a deceptive 'DeepSeek-Claw' skill that distributes malware. The campaign utilizes malicious installation instructions to deploy Remcos RAT on Windows via DLL sideloading and GhostLoader on macOS/Linux via obfuscated Node.js scripts, enabling persistent access and data exfiltration.
- domaincloudcraftshub[.]comPayload hosting domain
- filenameg2m.dllMalicious DLL sideloaded by the legitimate GoToMeeting executable to load Remcos RAT.
- filenameSKILL.mdDeceptive OpenClaw skill instruction file containing malicious execution commands.
- ip146[.]19[.]24[.]131Command and Control (C2) server IP address for Remcos RAT.
- mutexRmc-11YWBZMutex created by the Remcos RAT payload.
- urlhxxps://cloudcraftshub[.]com/apiRemote URL hosting the malicious MSI package containing Remcos RAT.
Detection / HunterGoogle
What Happened
Cybercriminals have created a fake 'skill' for an artificial intelligence automation tool called OpenClaw, disguising it as a legitimate integration for DeepSeek. Developers and organizations using OpenClaw AI agents on Windows, Mac, and Linux systems are primarily affected by this campaign. If installed, the fake skill secretly downloads malicious software that gives attackers remote control over Windows computers or steals passwords, cryptocurrency wallets, and sensitive developer keys on Mac and Linux. Organizations should carefully review and monitor any third-party plugins or skills before allowing them to run, and block the known malicious web addresses associated with this attack.
Key Takeaways
- Threat actors are weaponizing AI agentic workflows by publishing a deceptive 'DeepSeek-Claw' skill for the OpenClaw framework.
- The Windows attack chain uses a malicious MSI to sideload a DLL via a legitimate GoToMeeting executable, deploying Remcos RAT.
- The shellcode loader employs extensive evasion techniques, including ETW/AMSI patching, anti-debugging, and sandbox detection.
- Cross-platform environments (macOS/Linux) are targeted with GhostLoader via malicious npm scripts and bash installers to steal credentials and tokens.
Affected Systems
- Windows
- macOS
- Linux
- OpenClaw AI Agents
- Node.js environments
Attack Chain
The attack begins when a user or AI agent downloads a deceptive 'DeepSeek-Claw' skill for the OpenClaw framework. The skill's SKILL.md file contains malicious instructions that, on Windows, use msiexec to download an MSI package containing a legitimate GoToMeeting executable and a malicious DLL. The executable sideloads the DLL, which patches ETW and AMSI, performs anti-analysis checks, and decrypts the Remcos RAT payload in memory. On macOS/Linux, the instructions execute a bash script that triggers an obfuscated Node.js payload to install GhostLoader, which uses spoofed sudo prompts to steal credentials and exfiltrate data.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but details behavioral indicators and configuration artifacts for Remcos RAT and GhostLoader.
Detection Engineering Assessment
EDR Visibility: Medium — The malware actively patches ETW and AMSI in memory, which may blind some EDR telemetry. However, process creation (msiexec downloading remote payloads) and DLL sideloading by a signed binary should still be visible. Network Visibility: Medium — Initial MSI download is over HTTPS, and C2 communication uses TLS over TCP, encrypting the payload. However, the connection to an unusual port (2404) and known malicious IPs can be detected. Detection Difficulty: Moderate — The use of legitimate binaries for sideloading and in-memory patching of telemetry tools increases difficulty, but the initial msiexec command and subsequent network connections are highly anomalous.
Required Log Sources
- Process Creation (Event ID 4688 / Sysmon 1)
- Network Connections (Sysmon 3)
- Image Load (Sysmon 7)
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for msiexec.exe executing with the /q and /i flags pointing to an external HTTP/HTTPS URL, indicating potential remote payload execution. | Process Creation (Event ID 4688 / Sysmon 1) | Execution | Low |
| Identify instances of G2M.exe (GoToMeeting) loading an unsigned or unexpected g2m.dll from a non-standard directory, indicating DLL sideloading. | Image Load (Sysmon 7) | Defense Evasion | Low |
| Monitor for unexpected outbound network connections over non-standard ports (e.g., 2404) originating from legitimate processes like G2M.exe. | Network Connections (Sysmon 3) | Command and Control | Medium |
Control Gaps
- AI Agent execution context lacking strict behavioral controls
- EDR reliance on ETW/AMSI without memory integrity checks
Key Behavioral Indicators
- msiexec downloading from external URLs
- G2M.exe sideloading g2m.dll
- Spoofed sudo prompts in macOS/Linux terminals
- Creation of mutex Rmc-11YWBZ
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Block the identified C2 IP (146.19.24.131) and payload domain (cloudcraftshub.com).
- Search for and isolate any endpoints that have executed the DeepSeek-Claw OpenClaw skill.
Infrastructure Hardening
- Implement strict application control to prevent msiexec from downloading and executing remote packages.
- Restrict outbound network traffic to standard ports and block known malicious IPs.
User Protection
- Deploy EDR solutions capable of detecting in-memory patching and DLL sideloading.
- Enforce MFA and monitor for anomalous session cookie usage.
Security Awareness
- Educate developers on the risks of executing third-party AI agent skills and npm scripts.
- Train macOS/Linux users to be cautious of unexpected terminal sudo prompts.
MITRE ATT&CK Mapping
- T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain
- T1204.002 - User Execution: Malicious File
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- T1218.007 - System Binary Proxy Execution: Msiexec
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- T1059.007 - Command and Scripting Interpreter: JavaScript
- T1574.002 - Hijack Execution Flow: DLL Side-Loading
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1497.001 - Virtualization/Sandbox Evasion: System Checks
- T1027 - Obfuscated Files or Information
- T1056.002 - Input Capture: GUI Input Capture
- T1555.001 - Credentials from Password Stores: Keychain
- T1552.004 - Unsecured Credentials: Private Keys
- T1005 - Data from Local System
- T1539 - Steal Web Session Cookie
- T1071.001 - Application Layer Protocol: Web Protocols
Additional IOCs
- Ips:
146[.]19[.]24[.]131- Remcos C2 server
- Domains:
cloudcraftshub[.]com- Payload hosting domain
- Urls:
hxxps://cloudcraftshub[[.]]com/api- MSI download URLtcp+tls://146[[.]]19[.]24[.]131:2404/- Remcos C2 connection string
- File Paths:
SKILL.md- Malicious OpenClaw skill instruction filesetup.js- Obfuscated Node.js payload for GhostLoaderinstall.sh- Bash installer for GhostLoader
- Command Lines:
- Purpose: Download and execute remote MSI package | Tools:
cmd.exe,msiexec.exe| Stage: Execution |cmd /c start msiexec /q /i
- Purpose: Download and execute remote MSI package | Tools:
- Other:
Rmc-11YWBZ- Remcos Mutex
