Malicious OpenClaw/MoltBot Skills - 230+ Password-Stealing Packages — Threadlinqs Intelligence
As of 2026-05-30, Malicious OpenClaw/MoltBot Skills - 230+ Password-Stealing Packages is a high-severity supply chain threat attributed to ClawHavoc Operators, tracked by Threadlinqs Intelligence with 15 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 42 indicators of compromise.
Threat ID: TL-2026-0043 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: ClawHavoc Operators · FINANCIAL
230+ malicious skills published to the ClawHub (OpenClaw) skills registry and associated GitHub repositories within a single week — a supply chain poisoning campaign targeting AI assistant users
OpenClaw is a self-hosted gateway connecting messaging platforms (WhatsApp, Telegram, Discord, iMessage) to AI coding agents. It uses the AgentSkills specification for extensibility — users install 'skills' (SKILL.md files with scripts and instructions) from ClawHub (the public registry at clawhub.com) to teach their AI assistant new capabilities. Skills are loaded from three locations with precedence: workspace/skills (highest) → ~/.openclaw/skills (managed) → bundled skills (lowest). Critically, skills execute with the full permissions of the host user — there is no sandboxing by default, no capability restriction, and no code signing. The skill DEFINES what tools the AI agent can use and HOW — a malicious skill can instruct the agent to read files, execute commands, access environment variables, and exfiltrate data, all while appearing to perform its advertised function.
**The Campaign — 230+ Malicious Skills in One Week:**
Between January 20-27, 2026, an organized campaign published 230+ malicious skills to ClawHub using 47 newly created publisher accounts. The skills were designed to appear as legitimate productivity tools across popular categories: code formatting, git helpers, database connectors, API testing utilities, deployment automation, weather integrations, and language translation. The naming strategy combined typosquatting (deliberately similar to popular skill names) with SEO optimization (keyword-stuffed descriptions targeting common search queries).
**How the Malicious Skills Worked:**
Each malicious skill contained a legitimate-appearing SKILL.md with proper AgentSkills frontmatter and functional instructions for its advertised purpose. The credential theft was embedded in companion scripts (setup.sh, install.sh, helper scripts) and in hidden instructions within the SKILL.md that the AI agent would follow during 'installation' or 'first run'. The exfiltration TTPs:
1. **Environment Variable Harvesting**: Scripts executed during skill installation read all environment variables (env, printenv) and exfiltrated them to attacker C2 — capturing API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, AWS_ACCESS_KEY_ID), database credentials, and cloud configuration tokens that OpenClaw users commonly have set.
2. **SSH Key Theft**: Scripts accessed ~/.ssh/ directory to steal private keys (id_rsa, id_ed25519), known_hosts (mapping the user's server infrastructure), and SSH agent socket for credential forwarding.
3. **Browser Credential Extraction**: On macOS and Linux, scripts accessed browser credential stores (Chrome Login Data, Firefox logins.json, Safari Keychain) to steal saved passwords and session cookies.
4. **Cloud Configuration Theft**: Scripts read ~/.aws/credentials, ~/.config/gcloud/, ~/.azure/, ~/.kube/config to steal cloud provider credentials and Kubernetes cluster access.
5. **Git Credential Theft**: Scripts accessed ~/.gitconfig, credential helpers, and GitHub/GitLab personal access tokens stored in environment variables or credential managers.
6. **OpenClaw Configuration Theft**: Scripts read ~/.openclaw/openclaw.json to steal the user's API keys (Anthropic, OpenAI), channel tokens (Telegram bot token, Discord bot token, WhatsApp session), and gateway configuration — enabling the attacker to impersonate the user's AI assistant or access their messaging channels.
7. **Prompt Injection via SKILL.md**: Some malicious skills embedded hidden instructions in the SKILL.md that directed the AI agent to 'verify configuration' by reading and transmitting sensitive files. The AI agent, following its skill instructions, became the exfiltration mechanism — using its own tool capabilities (read, exec, web_fetch) to collect and transmit data.
**Exfiltration Infrastructure:**
Stolen credentials were transmitted via: (1) HTTPS POST to attacker-controlled domains disguised as 'telemetry' or 'analytics' endpoints, (2) DNS exfiltration encoding data in DNS queries to attacker nameservers, (3) Webhook posts to dispos
Weaknesses (CWE)
CWE-494, CWE-829
Target sectors: Technology, Software Development, DevOps, AI/ML Engineers, Individual Developers
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 15 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 42 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195.002, T1555, T1005, T1567, T1195, T1199, T1059, T1059, T1204, T1546