OpenClaw - Discord Webhook Notification (T1041)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•3

Correlates the completion of the OpenClaw theft routine with a network connection to Discord Webhooks to notify the threat actor. Specifically, it looks for network connections to discord.com/api/webhooks initiated by 'python.exe'.