Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Malicious OpenClaw Skill Distributes Remcos RAT and GhostLoader
Malware Families
Excerpt
IntroductionOpenClaw, previously known as Clawdbot, Moltbot, and Molty, is an open-source framework designed for autonomous AI agents that execute complex tasks requiring high-privilege local system access. While intended for automation, its modular "skill" architecture has been weaponized as a significant attack vector.In March 2026, Zscaler ThreatLabz identified a campaign leveraging the framework to exploit the growing adoption of agentic AI workflows. The threat actor…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 82536825e700f4c863238a90dd314687 | Medium | Score 53/100 | First seen |
| URL | https://cloudcraftshub.com/api | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…