Loading story…
Researchers found widespread supply-chain abuse in the OpenClaw ClawHub skill marketplace, identifying 341 malicious skills among 2,857 reviewed. Most of the malicious listings were tied to a coordinated campaign dubbed ClawHavoc, which used polished documentation and fake prerequisite steps to trick users into installing malware. On macOS, the skills directed OpenClaw to fetch and run obfuscated shell scripts and a fake OpenClawCLI component that ultimately delivered Atomic macOS Stealer (AMOS) as a universal Mach-O binary for both Intel and Apple Silicon systems; on Windows, the campaign used password-protected ZIP archives. The activity was also observed across multiple skill repositories and websites, showing that attackers are using AI agent workflows as a new malware delivery channel rather than relying only on direct user lures.
The AMOS payloads were reported to steal credentials, keychain contents, browser data, crypto-wallet information, Telegram sessions, Apple Notes, and files from common user directories before exfiltrating the data to attacker-controlled infrastructure. Researchers also found six additional malicious outlier skills using different techniques, including Polymarket-themed skills that embedded reverse-shell backdoors in otherwise normal code and another skill that sent a bot configuration file to a webhook. Koi Security said it reported the malicious skill list to ClawHub’s security team and released a defensive scanning skill, Clawdex, to help detect flagged skills before or after installation.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
On its publication date, TrendAI reported a campaign in which 39 malicious OpenClaw skills attempted to trick OpenClaw into installing a fake CLI component that fetched Atomic macOS Stealer. The report said the skills overlapped with Koi's larger ClawHavoc set and remained present in some repositories, including ClawHub's GitHub repository, at the time of writing.
Trend Micro published MDR analysis of an Atomic macOS Stealer campaign targeting macOS users through cracked applications. The reference provides only the publication date as an anchor for when this analysis occurred.
Koi launched Clawdex, a defensive skill intended to check ClawHub skills against a malicious-skills database before installation and to scan already installed skills retroactively. The tool was presented as a mitigation following the marketplace findings.
After identifying the malicious skills, Koi provided ClawHub's security team with the findings and the full list of flagged skills for removal. This was the direct disclosure step to the affected marketplace operator.
Koi analyzed the macOS infection chain used by ClawHavoc skills and assessed the downloaded universal Mach-O payload as Atomic macOS Stealer. The report described social-engineering instructions, staged shell execution from attacker infrastructure, and AMOS capabilities including theft of credentials, browser data, crypto wallets, Telegram sessions, files, and SSH material.
Koi Security audited the OpenClaw ClawHub skill marketplace and identified 341 malicious skills out of 2,857 total. Of these, 335 were assessed as part of a coordinated supply-chain campaign dubbed ClawHavoc, while six used separate techniques including reverse-shell and exfiltration behavior.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcetrendmicro.com
Open sourcekoi.ai
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that five malicious skills were uploaded to the OpenClaw/ClawHub AI agent marketplace and bypassed platform screening controls, despite ClawHub’s use of VirusTotal and ClawScan. The skills fell into three categories: macOS infostealer delivery, scanner evasion, and agentic abuse for financial gain. Two TradingView-themed skills redirected users through paste sites and used Base64-encoded `curl`-pipe-`bash` execution to install a macOS infostealer called **cluw**, while another skill, **omnicogg**, used a 22 MB padded `README.md` to evade scanning and linked to Atomic macOS Stealer infrastructure associated with `91.92.242[.]30`. Unit 42 also found two skills, **money-radar** and **letssendit**, that abused agent permissions without relying on traditional malware payloads. One forced affiliate-linked recommendations at runtime to generate commissions, while the other coordinated an agentic front-running scheme tied to a Solana meme-token pump-and-dump operation. OpenClaw said the reported accounts were banned and the skills removed from ClawHub, but the incident underscores a growing AI supply chain risk: marketplace skills can manipulate natural-language task execution while inheriting an agent’s authenticated access to files, shells, and credentials.
Jun 29, 2026
Google suspended access to its *Antigravity* (Gemini developer) platform for many **OpenClaw** users after detecting OAuth token abuse tied to OpenClaw’s third-party OAuth plugin, which was used to access subsidized Gemini tokens and drove backend load spikes and service degradation. Reports indicated sudden `403` errors and account restrictions, with some users claiming broader Google account impacts (e.g., loss of access to Gemini tooling and, in some cases, Workspace/Gmail). Google stated the activity violated terms by using Antigravity infrastructure to power non-Antigravity products and described the traffic as “malicious usage” patterns, offering limited reinstatement for some users who may have been unaware. Separately, Trend Micro reported a supply-chain style campaign abusing the OpenClaw ecosystem to distribute **Atomic (AMOS) Stealer** via malicious “skills.” Threat actors allegedly uploaded hundreds of malicious skills to repositories/marketplaces (e.g., *ClawHub* and *SkillsMP*), hiding instructions in `SKILL.md` to manipulate AI-agent workflows into presenting fake setup steps and prompting a human-in-the-loop password entry to complete infection. The AMOS variant was observed exfiltrating data including Apple and KeePass keychains and user documents, and Trend Micro noted the specific samples lacked persistence and ignored `.env` files; identified malicious skills were reportedly taken down, though code artifacts remained accessible in associated GitHub repositories at the time of reporting.
Jun 29, 2026
Researchers reported multiple campaigns abusing *AI agent “skills”* as a new supply-chain-like initial access vector. In one case, a malicious ClawHub skill (`bob-p2p`) masqueraded as a decentralized API marketplace and was promoted via the AI-agent social platform *Moltbook*; once installed, it caused agents to retain **plaintext Solana private keys** and execute transactions that bought worthless `$BOB` tokens while routing value to attacker-controlled infrastructure. Staiker researchers and analyst Dan Regalado highlighted that agent-to-agent collaboration, shared workflows, and dependency chains can enable **lateral movement without direct human interaction**, making the technique repeatable and scalable beyond crypto-wallet theft. Separately, Trend Micro described a shift in **Atomic macOS Stealer (AMOS)** distribution from cracked software to **malicious OpenClaw skills** hosted across ClawHub, SkillsMP, and GitHub. The campaign used seemingly benign `SKILL.md` instructions to trick models/users into installing a fake prerequisite (“OpenClawCLI”) from an external site; if followed, the workflow fetched and executed a **Base64-encoded command** that dropped a **Mach-O universal binary** (Intel and Apple Silicon). Trend Micro reported 39 malicious skills uploaded across repositories and stated that more than **2,200** malicious skills were ultimately found on GitHub, with AMOS targeting credentials, browser data, crypto wallets, Telegram data, VPN profiles, Apple Keychain items, and common user folders—underscoring that AI-agent ecosystems are becoming a practical malware delivery and data-theft channel.
Jun 29, 2026