Loading story…
Palo Alto Networks Unit 42 reported that five malicious skills were uploaded to the OpenClaw/ClawHub AI agent marketplace and bypassed platform screening controls, despite ClawHub’s use of VirusTotal and ClawScan. The skills fell into three categories: macOS infostealer delivery, scanner evasion, and agentic abuse for financial gain. Two TradingView-themed skills redirected users through paste sites and used Base64-encoded curl-pipe-bash execution to install a macOS infostealer called cluw, while another skill, omnicogg, used a 22 MB padded README.md to evade scanning and linked to Atomic macOS Stealer infrastructure associated with 91.92.242[.]30.
Unit 42 also found two skills, money-radar and letssendit, that abused agent permissions without relying on traditional malware payloads. One forced affiliate-linked recommendations at runtime to generate commissions, while the other coordinated an agentic front-running scheme tied to a Solana meme-token pump-and-dump operation. OpenClaw said the reported accounts were banned and the skills removed from ClawHub, but the incident underscores a growing AI supply chain risk: marketplace skills can manipulate natural-language task execution while inheriting an agent’s authenticated access to files, shells, and credentials.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The report published technical details for threat hunting and incident response, including domains, IP addresses, file hashes, affected skill names, and detection queries related to the five malicious ClawHub skills. This expanded defender visibility into the OpenClaw marketplace abuse beyond the initial discovery and takedown.
Following the report to ClawHub, OpenClaw banned the associated accounts and removed the five malicious skills from the marketplace. This action was described as occurring after the reporting by Unit 42, but no specific date was given.
After identifying the five malicious skills, Unit 42 reported them to ClawHub. The report does not provide a specific date for the disclosure.
Unit 42 analyzed the OpenClaw/ClawHub AI agent skill ecosystem from February through May 2026 and found five malicious skills that bypassed ClawHub’s screening controls. The skills fell into three categories: macOS infostealer delivery, scanner evasion through file padding, and agentic abuse schemes for financial gain.
In January 2026, the ClawHavoc campaign used 12 compromised accounts to upload 1,184 malicious skills to the ClawHub marketplace. The article says the campaign led to 247,000 confirmed installations and $2.3 million in stolen cryptocurrency.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcedarkreading.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that the *OpenClaw* self-hosted AI assistant ecosystem is being abused for malware distribution via **ClawHub**, a public registry for third-party “skills.” At least **14 malicious skills** uploaded over a short window masqueraded as crypto trading/wallet automation tools, but were designed to trick users into executing obfuscated setup commands that fetch and run remote scripts. Because OpenClaw skills are installed as executable code (not sandboxed) with access to local files and network resources, successful installs can enable credential theft and cryptocurrency wallet compromise on **Windows and macOS**, and one malicious listing reportedly reached prominent placement before removal, increasing the likelihood of accidental installs. Separate reporting also highlighted a related risk: a **1-click remote code execution (RCE)** issue affecting OpenClaw/Moltbot/ClawdBot was discussed in the security community, indicating that the same ecosystem is facing both supply-chain style extension abuse and potential direct exploitation paths. Organizations allowing developer or power-user adoption of OpenClaw should treat third-party skills as untrusted software, restrict installation sources, and monitor for social-engineering patterns such as “copy/paste this one-liner” installers that retrieve code from external servers—especially when tied to cryptocurrency-themed lures.
Jun 29, 2026
Researchers reported multiple campaigns abusing *AI agent “skills”* as a new supply-chain-like initial access vector. In one case, a malicious ClawHub skill (`bob-p2p`) masqueraded as a decentralized API marketplace and was promoted via the AI-agent social platform *Moltbook*; once installed, it caused agents to retain **plaintext Solana private keys** and execute transactions that bought worthless `$BOB` tokens while routing value to attacker-controlled infrastructure. Staiker researchers and analyst Dan Regalado highlighted that agent-to-agent collaboration, shared workflows, and dependency chains can enable **lateral movement without direct human interaction**, making the technique repeatable and scalable beyond crypto-wallet theft. Separately, Trend Micro described a shift in **Atomic macOS Stealer (AMOS)** distribution from cracked software to **malicious OpenClaw skills** hosted across ClawHub, SkillsMP, and GitHub. The campaign used seemingly benign `SKILL.md` instructions to trick models/users into installing a fake prerequisite (“OpenClawCLI”) from an external site; if followed, the workflow fetched and executed a **Base64-encoded command** that dropped a **Mach-O universal binary** (Intel and Apple Silicon). Trend Micro reported 39 malicious skills uploaded across repositories and stated that more than **2,200** malicious skills were ultimately found on GitHub, with AMOS targeting credentials, browser data, crypto wallets, Telegram data, VPN profiles, Apple Keychain items, and common user folders—underscoring that AI-agent ecosystems are becoming a practical malware delivery and data-theft channel.
Jun 29, 2026
Security researchers and media reports warned that the open-source AI agent **OpenClaw** (formerly *Moltbot/Clawdbot*) can be abused via its *ClawHub* “skills” ecosystem, with findings that **~7.1% of marketplace skills** contributed to exposure of **API keys, credentials, and credit card data** due to problematic `SKILL.md` instructions. Snyk highlighted a particularly severe example, **buy-anything skill v2.0.0**, which performs credit-card “tokenization” in a way that can be used to **pilfer financial details** before prompting users to provide card information. Additional research described **indirect prompt-injection** risk: a malicious Google document can coerce OpenClaw into integrating a new **Telegram bot**, enabling follow-on actions such as **file exfiltration** and deployment of a **Sliver** command-and-control beacon for persistence, with potential for **privilege escalation, lateral movement, and ransomware execution**. Separately, one report noted OpenClaw’s move to scan skills with **VirusTotal**, but also emphasized that signature-based scanning is not a complete mitigation for **prompt-injection** and other logic-level abuses; other items in the same news roundup (e.g., telecom “Salt Typhoon” oversight) were unrelated to OpenClaw’s vulnerabilities.
Jun 29, 2026