The malware GhostClaw steals developers' encrypted wallet data via an npm package.

PANews reported on March 23 that, according to Cryptopolitan, a new malware called GhostClaw is targeting encrypted wallets on macOS devices. This malware, disguised as the legitimate OpenClaw CLI tool, existed in the npm registry for a week, infecting 178 developers before being removed on March 10. Once a developer runs the "npm install" command, a hidden script globally installs the GhostClaw package, evading detection through obfuscated configuration files.

GhostClaw scans the clipboard every three seconds, capturing encrypted wallet and transaction-related data such as private keys, mnemonic phrases, and public keys. After downloading the payload in the second phase, GhostLoader scans encrypted wallet data in the Chromium browser, macOS Keychain, and system storage, clones browser sessions to gain access to logged-in wallets, and steals API tokens connected to AI platforms such as OpenAI and Anthropic. The stolen data is sent to the attackers via Telegram, GoFile, and command servers.