MalwareUsed by 1 actor

LuaJIT trojan

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TroyDen

The campaign deploys a custom LuaJIT trojan carefully designed to slip past automated security tools. Each malicious ZIP package contains three items: a batch file called Launch.bat, a renamed LuaJIT runtime named unc.exe, and an obfuscated Lua script hidden as license.txt.

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204.002Malicious FileEvidence1

Each malicious ZIP package contains three items: a batch file called Launch.bat, a renamed LuaJIT runtime named unc.exe, and an obfuscated Lua script hidden as license.txt.

Persistence

1 technique

T1112Modify RegistryEvidence1

Four registry writes disable Windows proxy auto-detection, pushing outbound traffic past corporate inspection layers.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

The most technically distinctive part of this campaign is the way its payload is split to avoid detection... a renamed LuaJIT runtime named unc.exe, and an obfuscated Lua script hidden as license.txt. When either file is submitted to an automated scanner on its own, it appears harmless.

T1036MasqueradingEvidence1

The attack centers on a convincingly built GitHub repository — AAAbiola/openclaw-docker — that impersonates a Docker deployment tool for the legitimate OpenClaw AI project. The repository features a polished README with installation instructions for both Windows and Linux, a companion GitHub.io page, and real contributors.

T1497Virtualization/Sandbox EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence, low RAM, short system uptime, elevated privilege access, and specific computer names. If anything looks like a sandbox, execution stops.

T1497.001System ChecksEvidence1

T1497.003Time Based ChecksEvidence1

If not, a Sleep() call kicks in for roughly 29,000 years, long enough to outlast any timed analysis window.

T1622Debugger EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence... If anything looks like a sandbox, execution stops.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Four registry writes disable Windows proxy auto-detection, pushing outbound traffic past corporate inspection layers.

Discovery

4 techniques

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

T1497.003Time Based ChecksEvidence1

If not, a Sleep() call kicks in for roughly 29,000 years, long enough to outlast any timed analysis window.

T1622Debugger EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence... If anything looks like a sandbox, execution stops.

Collection

1 technique

T1113Screen CaptureEvidence1

Every victim machine is geolocated the moment execution begins, and a full desktop screenshot is captured and sent to a C2 server in Frankfurt, Germany.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The payload then captures the full desktop and uploads it via a hardcoded multipart POST to the Frankfurt C2 server, which responds with encrypted task and loader blobs saved to the victim’s Documents folder.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Mar 25, 2026

AI-Assisted ‘OpenClaw Trap’ Campaign Uses Trojanized GitHub Repos to Target Developers and Gamers

A custom trojan delivered via fake GitHub repositories. It uses a split two-component payload with a renamed LuaJIT runtime and obfuscated Lua script to evade automated scanning and sandboxing, performs anti-analysis checks, disables Windows proxy auto-detection, captures desktop screenshots, and communicates with a C2 server to receive encrypted tasks and loader blobs.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

LuaJIT trojan

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TroyDen

via cyber security newscybersecuritynews.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1204.002Malicious FileEvidence1

Each malicious ZIP package contains three items: a batch file called Launch.bat, a renamed LuaJIT runtime named unc.exe, and an obfuscated Lua script hidden as license.txt.

Persistence

1 technique

T1112Modify RegistryEvidence1

Four registry writes disable Windows proxy auto-detection, pushing outbound traffic past corporate inspection layers.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

T1497.003Time Based ChecksEvidence1

If not, a Sleep() call kicks in for roughly 29,000 years, long enough to outlast any timed analysis window.

T1622Debugger EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence... If anything looks like a sandbox, execution stops.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Four registry writes disable Windows proxy auto-detection, pushing outbound traffic past corporate inspection layers.

Discovery

4 techniques

T1497Virtualization/Sandbox EvasionEvidence1

T1497.001System ChecksEvidence1

T1497.003Time Based ChecksEvidence1

If not, a Sleep() call kicks in for roughly 29,000 years, long enough to outlast any timed analysis window.

T1622Debugger EvasionEvidence1

Once both pieces are armed, the payload runs through five anti-analysis checks — scanning for debugger presence... If anything looks like a sandbox, execution stops.

Collection

1 technique

T1113Screen CaptureEvidence1

Every victim machine is geolocated the moment execution begins, and a full desktop screenshot is captured and sent to a C2 server in Frankfurt, Germany.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cyber security newsNews

Mar 25, 2026

AI-Assisted ‘OpenClaw Trap’ Campaign Uses Trojanized GitHub Repos to Target Developers and Gamers

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.