A new phishing campaign is putting crypto developers at risk by exploiting the popularity of Openclaw, a platform favored by open-source contributors. Cybersecurity firm OX Security has sounded the alarm, warning that threat actors are impersonating the Openclaw ecosystem through fake Github accounts, directly targeting users who are active in open-source projects. The campaign’s focus on engaged developers—and its sophisticated mimicry—has raised concerns across the industry.
Phishing Attack Promises Fake Tokens to Lure Targets
Attackers operate by opening “issue” threads on Github repositories, tagging users and falsely claiming they have won $5,000 worth of a so-called CLAW token. The deceptive messages contain links directing victims to a counterfeit website designed to closely mirror the real openclaw.ai portal. When users are prompted on this fraudulent page to connect their cryptocurrency wallets and comply, a series of malicious transactions are unleashed.
Wallet Connection Leaves User Assets Vulnerable
Technical analysis conducted by OX Security researchers Moshe Siman Tov Bustan and Nir Zadok revealed that once developers connect their wallets as instructed, their assets can be swiftly drained. The campaign employs social engineering tactics designed to personalize the interaction, making it appear especially credible to those who have previously interacted with Openclaw-related repositories. This individualized targeting increases the likelihood of success for the attackers.
Infrastructure and Malicious Code Exposed
Digging deeper, technical experts uncovered a complex attack infrastructure. Victims are redirected to the token-claw[.]xyz domain, while a command-and-control server is set up at watery-compost[.]today to manage the campaign. Malicious JavaScript embedded in the site harvests sensitive data such as wallet addresses and transaction details and transmits them back to the attackers.
Researchers identified a cryptocurrency wallet address likely associated with the attacker. They also noted that the malicious code tracks user actions and wipes local storage, making it significantly harder for investigators to trace the operation.
Although there have been no confirmed victims thus far, reports suggest the phishing campaign remains active. Security experts strongly caution people not to connect their cryptocurrency wallets to unfamiliar websites and to be skeptical of unsolicited token offers on Github, no matter how enticing they seem.
Meanwhile, a separate report by Certik drew attention to “skill scanning” vulnerabilities within the Openclaw ecosystem. Analyzed sample applications showed that these flaws could bypass established security layers, making exploitation feasible, Certik explained in its report.
Openclaw has recently surged in popularity among developers for its AI-powered agent systems. As the community around such platforms rapidly grows, their increasing appeal also marks them as prime targets for sophisticated cyber attacks.
