OpenClaw Skill Runs an install.sh Bootstrap on Unix

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•7

Detects bash or sh executing install.sh from an OpenClaw skill directory, matching the alternate macOS and Linux GhostLoader bootstrap path. This activity is associated with the malicious OpenClaw skill distributing Remcos RAT and GhostLoader.