Phishing Targets OpenClaw Developers via Fake GitHub Accounts

Cybercriminals have launched a targeted phishing campaign against developers contributing to the open-source AI agent project OpenClaw, using fake GitHub accounts to lure victims into connecting cryptocurrency wallets to fraudulent websites. The operation, first detailed by security researchers on March 15, 2025, exploits the platform's growing popularity to steal digital assets, though no confirmed losses have been reported.

The scam involves threat actors creating counterfeit GitHub profiles that mimic legitimate contributors. These accounts open issue threads in attacker-controlled repositories and tag OpenClaw developers, notifying them that they have been selected for a reward of 5,000 worth of CLAW tokens, a nonexistent cryptocurrency tied to the project. Victims are directed to malicious sites, such as tokenclaw.xyz and waterycompost.today, which closely replicate OpenClaw's official website at openclaw.ai. The fake pages include a prominent "Connect your wallet" button, prompting users to link popular wallets like MetaMask or Phantom to claim the prize.

Once connected, the sites deploy heavily obfuscated JavaScript code, including a file named eleven.js, to extract...