Malware GhostClaw steals developers' encrypted wallet data through npm packages

By: rootdata|2026/03/23 01:53:23

According to Cryptopolitan, a new type of malware called GhostClaw is targeting cryptocurrency wallets on macOS devices.

This malware disguised itself as a legitimate OpenClaw CLI tool and was present in the npm registry for a week before being removed after infecting 178 developers. Once developers run the "npm install" command, a hidden script globally installs the GhostClaw package and evades detection through obfuscated configuration files. GhostClaw scans the clipboard every three seconds, capturing private keys, seed phrases, public keys, and other cryptocurrency wallet and transaction-related data.

After the second stage payload is downloaded, GhostLoader scans for cryptocurrency wallet data in the Chromium browser, macOS Keychain, and system storage, clones browser sessions to gain access to logged-in wallets, and steals API Tokens that connect to AI platforms such as OpenAI and Anthropic. The stolen data is sent to the attackers via Telegram, GoFile, and command servers.

Peeling back its smooth trading interface to examine the underlying legal relationships and settlement processes, you will find that this is far from a simple "RWA asset revolution," but rather a complex game of interests involving spot pricing, rights ownership, and the monopoly of underlying custo...

In such a crowded cross-border payment arena, where is the next stop for the future?

Only by stepping into the mud can one have the chance to touch gold.

Why Is Bitcoin Down in 2026? What We Can Learn From 2022

Why is Bitcoin down in 2026? Bitcoin has just recorded its worst first half since 2022, with back-to-back quarterly losses, record ETF outflows, and extreme fear. Here's what history says, how 2026 differs from the last bear market, and the three signals traders should wat

The large models in the United States are moving towards closure in the name of security

The government successfully inserted itself as an approver between commercial AI models and their users for the first time.

From the white-haired stock god to the billionaire fund mogul, the smart people shorting Nvidia are all getting rich using the same framework

Give up on heavily investing in Nvidia's "nine major bottlenecks"! This article analyzes the underlying logic behind top AI investors making billions: physical infrastructure such as electricity, HBM, and optical interconnects are the true keys to wealth in AI hardware.

Morning Report | CoinEx becomes a key hub for Iran to evade sanctions, involving over $3.8 billion in funds; Kalshi seeks a new round of financing, with a valuation potentially rising to $40 billion

Overview of Important Market Events on June 25

Global Launch: As predictions become the most scarce asset in the AI era, Manadia is defining the next generation of the value internet

The trusted AI prediction ecosystem Manadia, which has secured $7 million in funding from well-known institutions like OKX, will globally launch in June. The core token UMXM has already been listed on multiple mainstream platforms, inviting you to seize the new blue ocean of the trillion-level predi...

Argentina vs Cape Verde: When a Record-Breaking Legend Meets an Unbreakable Underdog

How does Gate redo "buying and selling stocks" from the cryptocurrency world to the stock market?

The competition logic of exchanges has changed.

Former ByteDance employee's account: How I started with two Pinduoduo hard drives and made six times the profit with Seagate to achieve financial freedom?

Visa and Mastercard join 140 giants to launch a new stablecoin, but the impact on the market landscape may still be limited

WEEX Launches Depth Chart for Spot Trading

WEEX Spot now supports Depth Chart, helping users visualize buy and sell orders, spot liquidity walls, and understand market depth more clearly before placing trades.

MiCA reshuffle begins, Binance temporarily bids farewell to the EU

What Binance leaves behind is not scattered retail investors, but a whole batch of high-value users who are forced to liquidate and have almost nowhere to go.