A new malware called GhostClaw is targeting crypto wallets on macOS devices.

GhostClaw Malware Targets macOS Crypto Wallets—Disguised as OpenClaw Tool, Infected 178 Developers

A new threat is lurking in the npm registry. GhostClaw, a malware disguised as the legitimate OpenClaw CLI tool, infected 178 developers before being pulled on March 10. The attack triggered when devs ran "npm install," which silently installed the malicious package and hid behind obfuscated config files.

Once inside, GhostClaw went to work. It scans the clipboard every three seconds—grabbing private keys, seed phrases, and public keys. Then it downloads a second-stage payload, GhostLoader, which digs through Chromium browsers, macOS keychain, and system storage for crypto wallet data. It clones browser sessions to hijack logged-in wallets and steals API tokens from AI platforms like OpenAI and Anthropic. All stolen data is funneled out via Telegram, GoFile, and command servers. Another reminder: open-source tools come with open risks.