Malicious AI Agent Skills Abused for Crypto Theft and macOS AMOS Delivery

Researchers reported multiple campaigns abusing AI agent “skills” as a new supply-chain-like initial access vector. In one case, a malicious ClawHub skill (bob-p2p) masqueraded as a decentralized API marketplace and was promoted via the AI-agent social platform Moltbook; once installed, it caused agents to retain plaintext Solana private keys and execute transactions that bought worthless $BOB tokens while routing value to attacker-controlled infrastructure. Staiker researchers and analyst Dan Regalado highlighted that agent-to-agent collaboration, shared workflows, and dependency chains can enable lateral movement without direct human interaction, making the technique repeatable and scalable beyond crypto-wallet theft.

Separately, Trend Micro described a shift in Atomic macOS Stealer (AMOS) distribution from cracked software to malicious OpenClaw skills hosted across ClawHub, SkillsMP, and GitHub. The campaign used seemingly benign SKILL.md instructions to trick models/users into installing a fake prerequisite (“OpenClawCLI”) from an external site; if followed, the workflow fetched and executed a Base64-encoded command that dropped a Mach-O universal binary (Intel and Apple Silicon). Trend Micro reported 39 malicious skills uploaded across repositories and stated that more than 2,200 malicious skills were ultimately found on GitHub, with AMOS targeting credentials, browser data, crypto wallets, Telegram data, VPN profiles, Apple Keychain items, and common user folders—underscoring that AI-agent ecosystems are becoming a practical malware delivery and data-theft channel.