GitHub phishing scam targets crypto wallets

TLDR

A new phishing campaign on GitHub is tricking developers into connecting crypto wallets to malicious sites that can drain funds.

1. Attackers are impersonating OpenClaw on GitHub and offering fake $5,000 CLAW token airdrops that lead to wallet-draining websites.
2. The scam exploits connect wallet prompts and malicious approvals, a pattern that is becoming a major crypto attack vector.
3. You can reduce risk by distrusting surprise airdrops, checking URLs carefully, and treating every wallet approval as high-risk.

Deep Dive

1. What Is Happening

Security firm OX Security uncovered a coordinated GitHub phishing campaign that targets developers linked to the OpenClaw AI project.

Attackers create fake GitHub accounts, open issues in repos they control, and tag devs claiming they have won $5,000 in a non-existent CLAW token, directing them to a site that closely copies OpenClaws official page.

The cloned site adds a Connect your wallet button that supports wallets like MetaMask, WalletConnect, and Trust Wallet. Once connected and permissions are granted, obfuscated JavaScript can initiate malicious transactions and drain assets.

OX Security and multiple outlets report no confirmed victims so far, and OpenClaws creator has publicly stressed the project will never launch a token or airdrop.

2. Why This Attack Is Dangerous

This is a textbook approval phishing or wallet-drainer setup. The code waits for you to sign or approve something, then uses those permissions to move funds.

The malware tracks actions like PromptTx and Approved and sends data to a command server, with a nuke function to erase local traces, according to the technical analysis.

Because it runs through familiar flows (GitHub notifications, legit-looking sites, normal wallet UIs), it targets even experienced users and developers, not just retail newcomers.

3. How To Protect Your Wallet

1. Treat all you won a token or surprise airdrop messages as hostile until proven otherwise, especially if they arrive via GitHub, email, or DMs.
2. Verify URLs manually. Type the official domain into your browser instead of clicking links in GitHub issues, X posts, or emails.
3. Before signing, read what the wallet is asking. Avoid blind Approve for unknown tokens or contracts, which can give unlimited spending rights.
4. Use token approval checkers and revoke tools regularly, especially if you recently connected to any new dapps or airdrop sites.
5. Prefer hardware wallets for meaningful amounts. Even then, do not approve contracts you do not understand.

If you think you clicked a similar link, immediately revoke token approvals from that site and move remaining assets to a fresh wallet you control.

Conclusion

This GitHub phishing wave shows that attackers increasingly use social engineering around connect wallet prompts instead of direct protocol hacks. For crypto users, the best defense is skepticism toward unsolicited airdrops, strict URL hygiene, and treating every onchain approval like handing over the keys to your funds.