Bing AI Recommended a Fake OpenClaw Installer. It Delivered Vidar, GhostSocks, and Atomic Stealer.

What Happened

Huntress MDR discovered a campaign, disclosed in early March 2026, where threat actors registered GitHub organisations impersonating OpenClaw installers. The fake organisation — openclaw-installer — hosted repositories that appeared professional enough to fool Bing's AI-powered search at a glance.

When users searched for OpenClaw on Bing, the AI-generated results surfaced these malicious repos as recommended download sources — effectively doing the distribution work for the attackers with zero paid advertising. Huntress put it bluntly: "just hosting the malware on GitHub was enough to poison Bing AI search results."

To boost credibility, the threat actors copied real code from Cloudflare's Moltworker project into their repos — something an automated credibility signal might read as "this looks like real infrastructure code". It worked.

The official OpenClaw repository is at https://github.com/openclaw/openclaw. If you're not reading from there, you're not reading the real thing.

The Payload Chain — Two Platforms, Three Malware Families

Windows: Vidar + GhostSocks

Windows users following the fake installation instructions downloaded OpenClaw_x64.exe. That binary executed multiple payloads in sequence:

• Rust-based memory loaders — Multiple executables, all written in Rust, that loaded the final payloads directly into memory. No disk writes where endpoint tooling would typically look.
• Vidar infostealer — A well-documented stealer that harvests browser credentials, session tokens, crypto wallets, and anything else useful from the machine. Its C2 communication is unusual: Vidar resolves its command server address by scraping Telegram channel descriptions and Steam user profile pages — legitimate services that most corporate firewalls won't block.
• GhostSocks backconnect proxy — After stealing credentials, GhostSocks turns the victim's machine into a proxy node. Attackers then route their own traffic through it to bypass geo-based fraud detection and anti-abuse checks — including the kind that would flag a login from an attacker's VPS but not from the victim's own IP.

Huntress noted that their Managed AV and Managed Defender solutions caught and quarantined the payloads on the customer machine they analysed. That's a best-case scenario — enterprises with EDR deployed got visibility. Consumer users who followed the same instructions likely did not.

macOS: Atomic Stealer

The macOS path used a different delivery mechanism. Victims were shown a bash command to paste into Terminal — a pattern now so common it has a name: pastejacking. The command reached a second GitHub organisation (puppeteerrr, repository dmg) that contained shell scripts paired with Mach-O executables identified by Huntress as Atomic Stealer (also known as AMOS).

Atomic Stealer is a macOS infostealer with a solid pedigree — it targets browser data, iCloud Keychain content, macOS password prompts (fake UI that captures the user's login), and crypto wallet extensions. It's sold as crimeware-as-a-service and has seen active development since at least 2023.

Why Bing AI Is the Story Here

This campaign is notable less for the malware families — Vidar and Atomic Stealer are both known quantities — and more for how it found victims. The distribution channel was Bing's AI search, not phishing emails, not malicious ads, not SEO poisoning in the traditional sense.

AI-enhanced search results from Bing surface recommended content based on signals that include GitHub's own credibility metrics — stars, forks, commit activity, organisation affiliation. The attackers gamed exactly those signals: a named GitHub organisation, copied legitimate code in the repository, and enough apparent structure to look like a real project.

This is a different threat model than SEO poisoning, where attackers build pages optimised for search crawlers. Here, the attack surface is the LLM-layer summarisation and recommendation that sits on top of search — something that infers intent and trustworthiness without the same depth of vetting a security researcher would apply.

The practical implication: AI-powered search recommendations should be treated as suggestions, not endorsements. For software downloads especially, verify URLs directly against the official project.

Disclosure Status

Huntress reported all identified malicious repositories and accounts to GitHub. As of their disclosure date (early March 2026), removal status was unclear. GitHub's response to malicious repository reports varies in speed — if you encounter a repository claiming to offer OpenClaw outside the official org, report it directly at github.com/contact/report-abuse.

Microsoft has not issued a public statement about the Bing AI recommendation as of this writing.

Detection and Response

If You Downloaded from an Unofficial Source

Assume compromise. The immediate steps:

1. Isolate the machine — disconnect from the network if you have reason to believe the installer ran.
2. Credential rotation — every browser-saved password, every session token, every stored credential on that machine should be treated as stolen. Rotate all of them from a clean device.
3. Check for proxy activity — GhostSocks establishes an outbound TCP connection to the attacker's infrastructure. Look for unexpected outbound connections to unfamiliar IPs, especially persistent connections that survive reboots.
4. Crypto wallet audit — if you have any browser-based crypto extensions or wallet files on the machine, assume they were captured. Both Vidar and Atomic Stealer explicitly target wallet software.
5. Revoke active sessions — log out all sessions on Google, Microsoft, Apple, GitHub, and any SaaS tools used from that machine. Vidar captures session cookies, which bypass password-based authentication entirely.

IOC Summary (from Huntress)

• Malicious GitHub org: openclaw-installer
• Malicious repo: puppeteerrr/dmg
• Windows payload filename: OpenClaw_x64.exe
• C2 pattern: Vidar resolves C2 via Telegram/Steam profile scraping
• Proxy pattern: GhostSocks establishes persistent outbound TCP backconnect

Network-Level Detection

Because Vidar uses Telegram and Steam as C2 relay channels, straightforward domain blocklisting won't catch it. Detection requires behavioural analysis: look for new or unexpected processes making unusual sequences of requests to Telegram API endpoints (api.telegram.org) or Steam profile URLs shortly after software installation. A fresh browser process making a GET to a Telegram channel description within minutes of install is anomalous — flag it.

The Broader Pattern: GitHub + AI Search as Attack Surface

This campaign fits a wider playbook that's been evolving since 2023:

1. Target a popular open-source tool — OpenClaw, Node.js packages, Python utilities. Popularity means more search traffic and more user trust.
2. Create a plausible-looking repository — clone legitimate code, use a professional-sounding org name, add a README with installation instructions.
3. Wait for AI-assisted discovery — neither paid placement nor active SEO needed. LLM-based search assistants will surface it based on relevance signals alone.
4. Deliver payload via trusted mechanism — terminal commands look authoritative; users who "installed" the real tool via terminal are primed to follow the same instructions in a fake guide.

It's a supply chain attack that never touches the actual supply chain — it operates entirely in the discovery layer between "I want to install X" and "I'm on the official download page".

Related: Malicious Skills and Package Registries

This isn't the first time OpenClaw's ecosystem has been targeted. BleepingComputer previously reported on malicious Moltbot skills used to push password-stealing malware — in that case, attacker-controlled instruction files in the official skills registry. The GitHub installer campaign represents escalation: if the registry is being watched more closely, move the attack to the installation step.

Defender Checklist — AI Search Downloads

For any open-source tool installation, apply the following before running anything:

• ✅ Find the official repository independently — search the project name + "github" and confirm the org matches official documentation, not a search result.
• ✅ Check repository age and contributor history — a two-week-old org with one contributor and 0 stars is suspicious regardless of how polished the README looks.
• ✅ Verify the download URL in official docs — the project's own website or documentation should reference download URLs directly. If you can't find the URL in official docs, don't run the installer.
• ✅ Treat AI search results as suggestions, not endorsements — AI-generated results surface content based on signals that attackers can game. The recommendation box is not a security control.
• ✅ Scan before executing — even on macOS. Run installers through VirusTotal or your EDR before execution, especially for tools that request privileged access or system-level permissions.
• ✅ Bookmark the official repos — once you've verified the real URL, bookmark it. Every future update should come from that bookmark, not a new search.

Recommended Security Reading

Understanding how infostealers operate — and how to defend against them at an architectural level — is covered in depth in these:

• The Web Application Hacker's Handbook — session hijacking, credential theft mechanics, and defence patterns. The infostealer model is session-cookie theft in bulk; this book explains why rotating passwords alone isn't sufficient after credential compromise.
• Black Hat Python (2nd Edition) — covers network-level implant communication patterns, including the kind of backconnect proxy architecture GhostSocks uses. Useful for both understanding what defenders are up against and for writing detection tooling.
• YubiKey 5 NFC — Vidar steals session cookies. FIDO2 hardware keys mean that even with valid session cookies, an attacker cannot initiate a new authenticated session on a protected account without the physical key. For accounts you can't afford to lose, hardware MFA is the correct mitigation.

Source and Attribution

Primary source: Huntress MDR research, March 2026. Reported by BleepingComputer. Huntress identified the malicious repos, analysed the payload chain, and reported the repositories to GitHub.

The official OpenClaw installer is at https://github.com/openclaw/openclaw. No other installation source should be trusted.