OpenClaw Ecosystem Targeted by Malicious ClawHub Skills and Infostealer Theft of Agent Configuration Files

A supply-chain poisoning campaign dubbed ClawHavoc compromised OpenClaw’s official ClawHub marketplace by distributing 1,184 trojanized “Skills” intended to steal data and establish backdoor access on victim systems. Reporting attributes the initial disclosure to Koi Security, with Antiy CERT later tracking the activity as the TrojanOpenClaw PolySkill family and linking the uploads to 12 publisher accounts (including one responsible for 677 packages). The attackers abused ClawHub’s permissive publishing model (any GitHub account older than one week could upload), mass-posting Skills disguised as crypto trading bots, productivity tools, and social utilities; analysis described behaviors including ClickFix-style download prompts and reverse-shell droppers enabling remote command execution and persistence.

Separately, researchers reported infostealer activity exfiltrating sensitive files from victims’ local OpenClaw directories—openclaw.json, device.json, soul.md, and related memory files—highlighting how AI-agent artifacts can be leveraged beyond traditional credential theft. Hudson Rock assessed the malware as broadly harvesting files by extension rather than explicitly targeting OpenClaw, but warned dedicated modules are likely to emerge to decrypt/parse these agent files. The stolen data could enable attackers to connect to a victim’s local OpenClaw instance (notably if port 18789 is exposed) using gateway.auth.token, and potentially bypass “Safe Device” checks by abusing keys from device.json to sign messages as the victim’s paired device and access connected services.