A phishing campaign targeting developers in the OpenClaw ecosystem is spreading through GitHub, with attackers using fake token allocations to gain access to crypto wallets. According to a report from OX Security, threat actors created multiple fake GitHub accounts to open issue threads in attacker-controlled repositories, tagging dozens of developers and claiming they had been selected to receive a $5,000 reward in “CLAW” tokens. The messages referenced recipients’ GitHub contributions, making the ruse appear legitimate; researchers suspect attackers leveraged the GitHub “star” feature to identify users who had interacted with OpenClaw-related repos, enabling more convincing targeting.
Fake Website Mimics Official OpenClaw Platform
Victims were directed to a phishing site that closely replicated the official OpenClaw platform, with one critical difference: a “Connect your wallet” button. Once a wallet is connected, attackers obtain permissions to execute transactions and drain funds. The campaign infrastructure also used redirect links, including those routed through Google link-sharing services, ultimately leading to a malicious domain. Attackers created the accounts just hours before the campaign launched and deleted them soon after, a time-bound tactic to evade detection.
Obfuscated Code and Multi-Wallet Support Boost Risk
Technical analysis reveals that the phishing site relies on heavily obfuscated JavaScript, specifically in a file named “eleven.js”, to conceal its wallet-draining logic. Once executed, the malware captures wallet addresses, transaction values, and user identifiers, sending this data to a command-and-control server for real-time monitoring and unauthorized transactions. Built-in commands like “PromtTx,” “Approved,” and “Declined” track user actions. Notably, a “nuke” function removes traces of the malicious activity from browser local storage, complicating post-incident analysis. The phishing interface supports MetaMask, Trust Wallet, OKX Wallet, Bybit Wallet, and WalletConnect, widening the pool of potential victims. Researchers also identified a wallet address likely controlled by the attacker, used to receive stolen funds.
As of the report, no confirmed victims have been found, but OX Security warns the setup indicates a high-risk operation. The firm advises developers to treat unsolicited GitHub issues promoting token giveaways or airdrops with caution, especially when coming from unfamiliar accounts. Avoid connecting wallets to untrusted or newly surfaced sites; block known malicious domains; and regularly review and revoke suspicious wallet permissions. The incident highlights a growing pattern where attackers exploit trusted development platforms and trending projects for targeted phishing. With OpenClaw gaining attention, similar campaigns are likely to emerge.