GitHub phishing campaign clones OpenClaw pages to trick developers into wallet approvals and drain funds

Security researchers and community reports say a coordinated GitHub phishing campaign targeted OpenClaw developers by posting fake project pages promising free “CLAW” tokens and cash-equivalent airdrops to entice them to connect crypto wallets ^{[1] [2] [3]}.

According to an OX Security report and subsequent coverage, the scam directed victims to cloned sites that displayed a hidden wallet-connection prompt; when developers approved the prompt their wallets were drained. Reporters described the campaign as active and specifically leveraging OpenClaw branding to increase credibility ^{[4] [2] [1]}.

News outlets and the security report urged caution, advising developers to verify GitHub posts and URLs and to avoid approving wallet connections from untrusted or unexpected pages ^{[4] [2] [1]}.