Researchers found backdoors installed on U.S. company networks in the weeks prior to the U.S. and Israeli bombing campaign.
Malicious npm package '@openclaw-ai/openclawai' downloaded 178 times installs GhostLoader RAT, stealing credentials and crypto wallets.
Dubbed InstallFix by Push Security, the scheme inserts instructions to download malware during the Claude Code install process on cloned websites.