Early in March, security researchers uncovered a growing macOS malware campaign known as GhostClaw or GhostLoader. Initially discovered delivering malicious payloads via npm packages, the threat has now expanded its reach.
Threat actors are actively utilizing malicious GitHub repositories to distribute the malware, broadening the attack surface to include developers and automated artificial intelligence workflows.
These repositories impersonate legitimate developer tools, trading bots, and software development kits.
By populating the repositories with benign code and accumulating artificial engagement like hundreds of repository stars, attackers build trust before quietly introducing malicious components.
A unique aspect of this campaign is its targeting of AI-assisted development environments. Attackers use repositories containing specific manifest files designed for platforms where AI coding agents automatically discover and install external skills.
While the manifest files appear harmless, the malicious behavior triggers during the standard installation phase.
This allows the attacker to compromise systems through both direct user interaction and automated AI agent workflows, completely bypassing traditional package manager safeguards.
Multi-Stage Execution and Credential Theft
The infection follows a multi-stage execution chain designed to establish access and harvest macOS credentials without raising immediate suspicion.
The process begins when a user or AI agent runs a provided installation command, fetching an initial bootstrap script.
This script checks the host architecture and installs a compatible version of Node.js into a user-controlled directory, avoiding the need for elevated administrative privileges.
Notably, the script uses an insecure flag to turn off certificate verification during the download, weakening transport security.
Execution then transitions to heavily obfuscated JavaScript payloads. The core functionality resides in a setup script designed entirely to deceive victims.
It clears the terminal and presents fake progress indicators before prompting the user for their system password directly within the terminal window.
Instead of using native macOS authentication frameworks, the script validates the stolen password locally using built-in system directory utility commands.
Payload Delivery and Persistence
Once the malware successfully validates the stolen credentials, it contacts a remote command-and-control server to retrieve an jamf encrypted secondary payload.
| Technical Indicator | Associated Component | Operational Description |
|---|---|---|
install.sh | Initial Bootstrapper | Retrieves Node.js insecurely and triggers the setup environment variable execution. |
setup.js | Credential Harvester | Clears terminal, displays fake progress, and captures credentials via AppleScript and terminal prompts. |
To establish long-term persistence, the malware deletes its temporary files. It relocates to hidden directories that mimic legitimate developer activity. A post-installation script then clears the terminal to remove visible evidence of the attack.
It installs global packages to further blend in with normal system operations. This combination of anti-forensic techniques and the abuse of native macOS tools makes GhostClaw a highly evasive threat to developer environments.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
