OpenClaw Phishers: When Even Your Wallet Feels the Burn

by

Ah, the modern age! Where even one’s digital assets are not safe from the tender mercies of cyber charlatans. It appears the nefarious minds behind crypto’s darker arts have turned their attention to OpenClaw, leveraging its newfound popularity with the subtlety of a bull in a china shop.

  • The villains of this tale, in a display of ingenuity bordering on the theatrical, have adopted the esteemed moniker of OpenClaw on GitHub. They craft phony accounts, dispatch messages to developers promising a princely sum of $5,000 in $CLAW tokens-because nothing says “trust” like an unsolicited windfall.
  • Victims, lured by the gilded cage of a counterfeit website, are then presented with a malicious prompt masquerading as a digital hand of friendship. One click, and their wallets are drained with the efficiency of a Victorian vampire.
  • OX Security, ever the vigilant watchdogs, report the campaign employs obfuscated code and surgical targeting. Yet, curiously, no confirmed victims have been reported-perhaps the scammers are simply too inept to follow through.

In a report worthy of a West End play, OX Security details how these digital con artists have orchestrated a GitHub campaign so brazen it would make a Victorian pickpocket weep. Fake repositories, fake issues, fake camaraderie-all in the name of draining wallets and denting reputations.

One particularly dastardly message informs the unwary developer they’ve been “selected” for a $CLAW allocation, a privilege so rare it might as well be a knighthood. Alas, the prize lies in a cloned website so convincing, one might mistake it for the real thing-were it not for the suspiciously misspelled URL.

On this digital stage, the villainous prompt demands a wallet connection, a simple act that triggers a cascade of chaos. The wallet, once linked, is promptly emptied with the grace of a heist film, leaving the victim to ponder how they fell for such a clumsy trick.

This audacious campaign coincides with OpenClaw’s ascension into the limelight, thanks in part to the illustrious Sam Altman’s endorsement. OpenClaw, now a foundation-run open source project, has become a magnet for both innovation and… less savory attention.

OX Security suggests the scammers exploit GitHub’s star feature to identify enthusiasts of OpenClaw, thereby cloaking their deceit in a veneer of legitimacy. A clever tactic, though one wonders if the stars themselves would endorse such shenanigans.

The malefactors’ weapon of choice? A file ominously named “eleven.js,” which embeds wallet-stealing code in obfuscated JavaScript. Once activated, a “nuke” function erases browser traces with the subtlety of a bomb disposal expert, ensuring the scammers can continue their mischief undetected.

This digital malware, with commands such as PromptTx and Approved, sends encrypted data-including wallet addresses and transaction values-to a command-and-control server. One suspects the server’s operators are already planning their next holiday.

OX Security has kindly provided a list of domains to block, including token-claw[.]xyz and watery-compost[.]today. A reminder, perhaps, that the internet is a garden best tended with caution.

In the interim, OpenClaw’s creator, Peter Steinberger, has instituted a strict anti-crypto policy. Any mention of cryptocurrencies in their Discord server is met with swift removal. A bold move, especially after a recent $CLAWD token scam inflated to $16 million before collapsing like a soufflé.

Read More

2026-03-19 11:28