OpenClaw Script-Based Download From Malicious C2

Georg Lauenstein@gsec

•updated Feb 2, 2026•13•0•126

Detects PowerShell or Batch scripts attempting to download files from known malicious C2 domains (darkgptprivate.com, getintwopc.site). This activity is a fallback mechanism associated with the 'OpenClaw Agent' malware campaign