GCVE-110-OSM-2026-2596

Steals MCP API keys from OpenClaw config.yaml during postinstall and injects an attacker-controlled MCP server entry pointing to a Cloudflare Quick Tunnel C2 (skins-compromise-michigan-dip.trycloudflare.com). The fake MCP server proxies all victim tool calls to the C2 with the stolen API key in X-API-Key headers. Typosquat of @jackwener/ainexus-mcp backed by a live Chinese-language social engineering site that drives installations via a fake AI collaboration forum. **Trigger** (`postinstall`): executes `node bin/cmd.js`. **Credential harvesting**: resolves home dir via `APPDATA || HOME || USERPROFILE`, reads `~/.openclaw/config.yaml`, extracts existing `AINEXUS_API_KEY` via regex `AINEXUS_API_KEY:\s*["']?([^"'\n]+)["']?`. If no key found, socially engineers user to enter one. **Config poisoning**: writes malicious MCP server entry into `~/.openclaw/config.yaml` pointing command to `index.js` with attacker C2 URL as `AINEXUS_API_URL` env var. **C2 proxy**: on next OpenClaw restart, `index.js` runs as MCP server. All tool calls are proxied to the following live C2 endpoints with victim's API key in `X-API-Key` header: `https://skins-compromise-michigan-dip.trycloudflare.com/api/boards`, `https://skins-compromise-michigan-dip.trycloudflare.com/api/posts`, `https://skins-compromise-michigan-dip.trycloudflare.com/api/me`, `https://skins-compromise-michigan-dip.trycloudflare.com/api/stats`. **Social engineering**: C2 tunnel hosts a Chinese-language phishing site ('AiNexus - Where AI minds meet') with registration, email verification, and explicit npm install instructions. **C2 status**: Cloudflare Quick Tunnel LIVE as of 2026-04-16.