Phishing Alert - GitHub Targeted with Fake OpenClaw Tokens
Basically, hackers are tricking developers on GitHub into giving away their crypto wallets.
A new phishing campaign is targeting GitHub developers with fake OpenClaw token giveaways. Users risk losing their crypto wallets if they connect to malicious sites. Stay alert and avoid engaging with suspicious messages.
What Happened
Threat actors are leveraging the viral popularity of OpenClaw to execute a sophisticated phishing campaign targeting developers on GitHub. The attackers are promoting fake CLAW token airdrops, claiming to offer thousands of dollars in rewards. Developers are lured into malicious GitHub repositories and discussions, ultimately leading them to cloned websites that prompt them to connect their crypto wallets.
The attackers create issues in controlled repositories, tagging GitHub users to maximize visibility. This strategy is designed to exploit the trust developers have in the GitHub platform, making them more likely to engage with the phishing attempts. The cloned site mimics the legitimate openclaw.ai but includes a deceptive “connect your wallet” button aimed at stealing wallet information.
Who's Being Targeted
The phishing campaign specifically targets developers who have shown interest in OpenClaw-related projects. By creating or hijacking repositories and using social engineering tactics, attackers increase the credibility of their scams. Messages sent to potential victims often read, “Appreciate your contributions on GitHub. We analyzed profiles and chose developers to get OpenClaw allocation,” framing the scam as a limited-time offer.
This approach not only captures the attention of developers but also makes the phishing attempts appear more legitimate. The attackers may even use GitHub’s star feature to identify users who have starred OpenClaw repositories, tailoring their messages to seem relevant and personalized.
Signs of Infection
The phishing code is cleverly hidden within a JavaScript file called eleven.js. This code is highly obfuscated, making it difficult to detect. The attackers have set up a command-and-control (C2) server at watery-compost[.]today to collect sensitive information, including wallet addresses and transaction values.
The phishing page, hosted at token-claw[.]xyz, supports multiple crypto wallets, including WalletConnect and MetaMask. The malware also includes a “nuke” function that deletes wallet-stealing information from the browser’s local storage to evade detection. The threat actor’s wallet address has been identified, which is used to receive stolen cryptocurrency.
How to Protect Yourself
To safeguard against this phishing campaign, users should take immediate action. It is crucial to block the phishing domain from all environments and avoid connecting crypto wallets to untrusted websites. Users should be wary of any token giveaway messages from unknown sources and treat them as suspicious.
Additionally, reviewing recent wallet connections and revoking approvals associated with this campaign is advisable. By staying vigilant and informed, developers can protect themselves from falling victim to such scams.
CSO Online