OpenClaw
OpenClaw is an open-source, self-hosted autonomous AI agent framework, previously referred to as MoltBot and Clawdbot, built with Node.js and designed to run locally on user systems. It is described as capable of browsing the web, writing code, executing arbitrary shell commands, reading and writing host files, accessing internal network services, and integrating with messaging and calendar platforms. Its architecture includes a local gateway/WebSocket server and connected nodes that can expose capabilities such as shell execution and access to local resources.
The content shows OpenClaw appearing in multiple security incidents and malicious-use contexts in 2026. A compromised npm publishing token was used to publish Cline CLI v2.3.0 with a postinstall hook that silently ran "npm install -g openclaw@latest", causing unauthorized installation of OpenClaw on developer machines for roughly eight hours on February 17, 2026; reporting cited about 4,000 downloads during that window. The Cline maintainers stated the installation was unauthorized and unintended. Separate reporting states attackers have installed and operated OpenClaw via Claude to execute commands on victim systems, often alongside living-off-the-land techniques.
OpenClaw is also described as being exploited by multiple threat groups. One report says a China-linked automated cybercrime operation used a centralized backend called Paperclip and an agent-based workflow system known as OpenClaw to orchestrate large-scale exploitation of internet-facing assets, especially in fintech, Web3, and security sectors, using vulnerabilities including Log4Shell and 2025 RCEs. Another report states widespread exploitation of OpenClaw deployments followed shortly after its viral adoption, including abuse through exposed administrative interfaces, credential harvesting, malicious skills, and CVE-2026-25253.
A high-severity vulnerability chain in OpenClaw’s core architecture allowed a malicious website to connect to the localhost-bound gateway over WebSocket, brute-force gateway authentication because localhost attempts were not rate-limited or logged, and then gain administrative control of the agent. With authenticated access, an attacker could register as a trusted device, enumerate connected nodes, dump configuration and logs, exfiltrate data, and potentially execute shell commands on connected devices. The issue was fixed in OpenClaw version 2026.2.25 and later. Separate reporting on CVE-2026-25253 states it enabled remote code execution or account takeover scenarios involving token theft after a victim clicked a malicious link.
The ecosystem around OpenClaw is also described as risky. ClawHub, a public registry for OpenClaw skills, is reported to have hosted malicious skills disguised as legitimate utilities or productivity tools, including backdoors, credential stealers, and infostealers. Reporting cited more than 1,000 malicious skills in the marketplace in one case, and another source said 8-12% of audited skills were malicious. Threat-hunting guidance in the content recommends looking for process names such as openclaw, clawdbot, or moltbot; modifications under ~/.openclaw/skills/; OpenClaw spawning shells such as sh, bash, or zsh; reads of sensitive files such as ~/.aws/credentials; and outbound curl/wget activity to unfamiliar IPs.
Observed malicious outcomes associated with OpenClaw in the content include theft of configuration files, tokens, API keys, SSH keys, AWS credentials, Stripe tokens, PostgreSQL credentials, and other secrets; message interception; persistence via a background gateway daemon; and use as a high-privilege foothold on developer or administrative endpoints. One report mentions a Vidar variant exfiltrating configuration files, tokens, and API keys from an OpenClaw deployment. Another describes exposed or default administrative interfaces on port 18789 and misconfigurations such as binding to 0.0.0.0, missing authentication, and reverse-proxy header bypasses. The content also references failed installation attempts of OpenClaw on infrastructure used by an operator experimenting with Sliver and Metasploit, and describes OpenClaw as a Node.js-based botnet framework with a local API endpoint on port 18789.
Overall, the supporting content consistently characterizes OpenClaw as a legitimate but high-risk autonomous agent platform whose capabilities and local privileges make it attractive for unauthorized installation, post-compromise abuse, credential theft, persistence, and remote control when misconfigured, maliciously extended, or exploited.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
A high-severity security vulnerability has been disclosed in Docker Engine that could permit an attacker to bypass authorization plugins under specific circumstances. The vulnerability, tracked as CVE-2026-34040 (CVSS score: 8.8), stems from an incomplete fix for CVE-2024-41110.
We have identified widespread exploitation of OpenClaw (formerly MoltBot and ClawdBot) AI agents by multiple threat groups...
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
the same wallet addresses, Aptos fallback identifiers, XOR keys, and config-file injection pattern appear in public victim reports, including development-team compromise and OpenClaw malware write-ups
A component called hackerbot-claw uses an AI agent (openclaw) for automated attack targeting.
Techniques & procedures
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
2 techniques
Reconnaissance
Resource Development
1 technique
Resource Development
Initial Access
6 techniques
Initial Access
The incident occurred on Tuesday, when an "unauthorized party" used a compromised token to publish an update to Cline CLI on its npm registry...
However, when javascript code served by a website running in the user’s browser creates a websocket, it uses the user’s own network interface to make the connection. This means malicious code running in a browser can evade the security restrictions and connect to the browser relay websocket...
The workflow was configured so that any GitHub user could trigger it by opening an issue, but it failed to properly check whether the information supplied in the title was potentially hostile.
Someone compromised open source AI coding assistant Cline CLI's npm package earlier this week in an odd supply chain attack ... an "unauthorized party" used a compromised token to publish an update to Cline CLI on its npm registry that installs OpenClaw on users' computers when they install cline@2.3.0.
Execution
5 techniques
Execution
OpenClaw could create a new attack surface in which AI agents can run for weeks and months, and activate after a long slumber.
можно детектировать процессы openclaw, nanoclaw, nemoclaw, clawdbot, а также наличие на устройстве Node.js и запуск из него bash, python и подобных сервисов
"modified package.json with an added postinstall script: 'postinstall": "npm install -g openclaw@latest.'"
Persistence
3 techniques
Persistence
OpenClaw could create a new attack surface in which AI agents can run for weeks and months, and activate after a long slumber.
Privilege Escalation
3 techniques
Privilege Escalation
OpenClaw could create a new attack surface in which AI agents can run for weeks and months, and activate after a long slumber.
Stealth
1 technique
Stealth
Defense Impairment
1 technique
Defense Impairment
Credential Access
4 techniques
Credential Access
The flaw allowed malicious websites to abuse its browser relay server and steal cookies from other tabs open in the same browser. An attacker who can induce a user to visit a malicious site can hijack active sessions from unrelated websites, including from services like gmail or microsoft 365.
"...granting it broad access to software, including online services, email, login tokens..."; "...maintain persistent tokens across sessions, allowing it to operate without constant re-authentication."
Discovery
3 techniques
Discovery
The hex packet changed from querying '_clawdbot-gw._tcp.local' (specific service) to '_services._dns-sd._udp.local' (generic DNS-SD enumeration). This returns ALL mDNS services on the target, not just openclaw/clawdbot.
Lateral Movement
1 technique
Lateral Movement
Collection
2 techniques
Collection
Command and Control
2 techniques
Command and Control
Runner scripts inside the Bissa scanner framework were hardcoded with a Telegram bot token linked to a bot called @bissapwned_bot. Every time the scanner confirmed a successful React2Shell exploit, the bot sent a structured alert directly to the attacker’s private Telegram chat.
IOCs tracked for this family
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named malware referenced as sharing the same wallet addresses, XOR keys, and config-file injection pattern as the malicious JavaScript loader in this incident.
OpenClaw is described as a tool installed on victim systems that can be operated via Claude to execute commands, functioning as a remote command execution or access capability in AI-assisted intrusions.
You May Also Like Application Security Supply Chain Attack Secretly Installs OpenClaw for Cline Users
Agent-based workflow system used to automate campaign stages including planning, review, dispatch, reconnaissance, scanning, validation, and reporting on stolen data.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.