OpenClaw - GitHub Raw Exfiltration / Command Pull (T1105)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•2

Detects the infostealer communicating with raw.githubusercontent.com to pull secondary modules or exfiltrate small data fragments via URL params, specifically when initiated by 'python.exe'.