Summary
A new malware campaign has been identified where hackers are using a fake installer for the legitimate OpenClaw software to distribute malicious payloads. The attackers have created a fraudulent installer named "OpenClaw Installer" that, when executed, drops several malicious executables onto the victim's system. These include svc_service.exe, onedrive_sync.exe, and virtnetwork.exe.
The malware is designed to steal cryptocurrency wallet credentials and password manager data by targeting specific directories such as %APPDATA%\Ledger Live for Ledger hardware wallets. The attackers also use various persistence mechanisms, including registry keys and startup LNK files, to ensure the malware remains active on infected systems.
Key Points
-
Malware Distribution:
- A fake installer named "OpenClaw Installer" is being used.
- Upon execution, it drops multiple malicious executables (
svc_service.exe,onedrive_sync.exe, andvirtnetwork.exe).
-
Persistence Mechanisms:
- Registry keys are modified to ensure the malware runs on system startup.
- LNK files in the Startup folder are created for persistence.
-
Targeted Data Theft:
- The malware targets cryptocurrency wallets
Read the full article at Cyber Security News
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
![[AINews] The Unreasonable Effectiveness of Closing the Loop](/_next/image?url=https%3A%2F%2Fmedia.nemati.ai%2Fmedia%2Fblog%2Fimages%2Farticles%2F600e22851bc7453b.webp&w=3840&q=75)
