GitHub 'OpenClaw Deployer' Repo Delivers Trojan Instead

Netskope Threat Labs uncovered "TroyDen's Lure Factory," a large-scale campaign distributing 300+ Trojanized GitHub packages (posing as OpenClaw deployers, game cheats, trackers, scripts, and more) that embed a LuaJIT-based Trojan. The malware uses a renamed Lua runtime paired with an encrypted script and anti-analysis tricks (including an extreme sleep delay and multi-file activation) to bypass automated detection, then captures desktop screenshots, collects geolocation and credentials, and exfiltrates data to a C2 in Frankfurt, creating a serious software supply-chain and credential-theft risk.