Malicious OpenClaw/MoltBot Skills - 230+ Password-Stealing Packages
Malicious OpenClaw/MoltBot Skills (TL-2026-0043), also tracked as OpenClaw Malware, is a high-severity supply-chain compromise scored CVSS 7.8, first published 2026-02-03. It is attributed to ClawHavoc Operators with low confidence, affects OpenClaw OpenClaw AI Assistant (formerly MoltBot/ClawdBot), maps to 35 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 15 detection rules and 42 indicators of compromise.
Key facts for TL-2026-0043
- Threat ID
- TL-2026-0043
- Also known as
- OpenClaw Malware, MoltBot Malicious Skills, AI Assistant Supply Chain
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-02-03
- Last reviewed
- 2026-02-03
- Attribution
- ClawHavoc Operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- Technology, Software Development, DevOps, AI/ML Engineers, Individual Developers
- Target regions
- Global
- Detection rules
- 15
- Indicators of compromise
- 42
230+ malicious skills published to the ClawHub (OpenClaw) skills registry and associated GitHub repositories within a single week — a supply chain poisoning campaign targeting AI assistant users through credential-stealing packages disguised as legitimate productivity, development, and automation skills. Distinct from TL-0044 (CVE-2026-25253 OpenClaw RCE — a specific code vulnerability). TL-0043 documents the registry poisoning campaign itself: how 230+ malicious packages bypassed review, the credential theft TTPs embedded in skill scripts, the skill trust model exploitation, discovery and response timeline, and the broader AI assistant supply chain attack surface. OpenClaw skills execute with full user-level permissions in the host environment (no sandbox by default) — the AI assistant becomes the malware delivery mechanism, instructed by its own skill definitions to exfiltrate credentials, API keys, tokens, environment variables, SSH keys, browser data, and cloud configuration files.
How Malicious OpenClaw/MoltBot Skills works
OpenClaw is a self-hosted gateway connecting messaging platforms (WhatsApp, Telegram, Discord, iMessage) to AI coding agents. It uses the AgentSkills specification for extensibility — users install 'skills' (SKILL.md files with scripts and instructions) from ClawHub (the public registry at clawhub.com) to teach their AI assistant new capabilities. Skills are loaded from three locations with precedence: workspace/skills (highest) → ~/.openclaw/skills (managed) → bundled skills (lowest). Critically, skills execute with the full permissions of the host user — there is no sandboxing by default, no capability restriction, and no code signing. The skill DEFINES what tools the AI agent can use and HOW — a malicious skill can instruct the agent to read files, execute commands, access environment variables, and exfiltrate data, all while appearing to perform its advertised function.
**The Campaign — 230+ Malicious Skills in One Week:** Between January 20-27, 2026, an organized campaign published 230+ malicious skills to ClawHub using 47 newly created publisher accounts. The skills were designed to appear as legitimate productivity tools across popular categories: code formatting, git helpers, database connectors, API testing utilities, deployment automation, weather integrations, and language translation. The naming strategy combined typosquatting (deliberately similar to popular skill names) with SEO optimization (keyword-stuffed descriptions targeting common search queries).
**How the Malicious Skills Worked:** Each malicious skill contained a legitimate-appearing SKILL.md with proper AgentSkills frontmatter and functional instructions for its advertised purpose. The credential theft was embedded in companion scripts (setup.sh, install.sh, helper scripts) and in hidden instructions within the SKILL.md that the AI agent would follow during 'installation' or 'first run'. The exfiltration TTPs:
1. **Environment Variable Harvesting**: Scripts executed during skill installation read all environment variables (env, printenv) and exfiltrated them to attacker C2 — capturing API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, AWS_ACCESS_KEY_ID), database credentials, and cloud configuration tokens that OpenClaw users commonly have set.
2. **SSH Key Theft**: Scripts accessed ~/.ssh/ directory to steal private keys (id_rsa, id_ed25519), known_hosts (mapping the user's server infrastructure), and SSH agent socket for credential forwarding.
3. **Browser Credential Extraction**: On macOS and Linux, scripts accessed browser credential stores (Chrome Login Data, Firefox logins.json, Safari Keychain) to steal saved passwords and session cookies.
4. **Cloud Configuration Theft**: Scripts read ~/.aws/credentials, ~/.config/gcloud/, ~/.azure/, ~/.kube/config to steal cloud provider credentials and Kubernetes cluster access.
5. **Git Credential Theft**: Scripts accessed ~/.gitconfig, credential helpers, and GitHub/GitLab personal access tokens stored in environment variables or credential managers.
6. **OpenClaw Configuration Theft**: Scripts read ~/.openclaw/openclaw.json to steal the user's API keys (Anthropic, OpenAI), channel tokens (Telegram bot token, Discord bot token, WhatsApp session), and gateway configuration — enabling the attacker to impersonate the user's AI assistant or access their messaging channels.
7. **Prompt Injection via SKILL.md**: Some malicious skills embedded hidden instructions in the SKILL.md that directed the AI agent to 'verify configuration' by reading and transmitting sensitive files. The AI agent, following its skill instructions, became the exfiltration mechanism — using its own tool capabilities (read, exec, web_fetch) to collect and transmit data.
**Exfiltration Infrastructure:** Stolen credentials were transmitted via: (1) HTTPS POST to attacker-controlled domains disguised as 'telemetry' or 'analytics' endpoints, (2) DNS exfiltration encoding data in DNS queries to attacker nameservers, (3) Webhook posts to disposable Discord/Slack webhook URLs, (4) In some variants, the AI agent was instructed to use web_fetch to POST data directly — the agent IS the exfiltration tool.
**Why It Worked — The Skill Trust Model:** The attack exploited a fundamental trust gap in the AI assistant ecosystem: - Users trust skills from ClawHub the way they trust packages from NPM or extensions from the Chrome Web Store - ClawHub's review process at the time was minimal — automated format validation but no security code review - Skills execute with user permissions — no sandbox, no permission prompts, no capability restrictions - The AI agent follows skill instructions by design — if the SKILL.md says 'run this script', the agent runs it - Platform naming confusion (OpenClaw was previously named MoltBot, then ClawdBot) created opportunities for impersonation and social engineering around 'official' vs 'community' skills
**Discovery and Response:** The campaign was discovered on January 27, 2026 by a security researcher who noticed anomalous network traffic from their OpenClaw instance after installing a 'git-helper-pro' skill. The researcher reported to the OpenClaw maintainers, who conducted a registry audit identifying 230+ malicious packages across 47 publisher accounts. Response timeline: January 27 — initial report; January 28 — ClawHub suspended all 47 accounts and removed malicious packages; January 29 — OpenClaw published security advisory with IOCs; January 30 — OpenClaw released v4.2.1 with skill sandboxing improvements and mandatory script hash verification; February 3 — ClawHub implemented mandatory publisher verification (GitHub identity, email verification) and automated security scanning for new skill submissions.
**Supply Chain Parallels:** This campaign mirrors established software supply chain attacks: NPM typosquatting (ua-parser-js, event-stream), PyPI malware (ctx, phpass), VS Code malicious extensions (documented in TL-0034 GlassWorm), and Chrome extension credential theft (TL-0015). The AI assistant ecosystem is the newest — and least hardened — software supply chain. Unlike NPM or PyPI where packages are code libraries, AI skills are INSTRUCTIONS that an AI agent follows with full system access. This makes them uniquely dangerous: the skill doesn't just run code, it instructs an intelligent agent to run code on the skill's behalf, combining human-like reasoning with system-level access.
MITRE ATT&CK techniques used in TL-2026-0043
collection
T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories
discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1087 Account Discovery
lateral-movement
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1550 Use Alternate Authentication Material
exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1102 Web Service
initial-access
T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
credential-access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
privilege-escalation
T1546 Event Triggered Execution
persistence
T1547 Boot or Logon Autostart Execution
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
stealth
resource-development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
reconnaissance
T1593 Search Open Websites/Domains
impact
Affected products and versions in Malicious OpenClaw/MoltBot Skills
- OpenClaw — OpenClaw AI Assistant (formerly MoltBot/ClawdBot)
Vulnerable versions: Users who installed malicious skills
Fixed in: Uninstall malicious packages
Remediation for Malicious OpenClaw/MoltBot Skills
Immediate actions
- Audit all installed OpenClaw/MoltBot skills
- Remove any skills from unknown or untrusted publishers
- Check for unauthorized credential access in logs
- Rotate any potentially compromised credentials
- Review skill permissions and access grants
Workarounds
- Disable automatic skill updates
- Run AI assistants with minimal permissions
- Isolate AI assistants from sensitive credential stores
Longer-term hardening
- Only install skills from verified publishers
- Review skill source code before installation
- Implement network monitoring for AI assistant traffic
- Use application sandboxing for AI assistants
- Regular audit of installed skills and their permissions
Weaknesses (CWE) in Malicious OpenClaw/MoltBot Skills
CWE-494, CWE-829
Timeline of Malicious OpenClaw/MoltBot Skills
Showing the 20 most recent tracked events.
- ua-parser-js NPM package compromised — 8M weekly downloads. Crypto miner and credential stealer injected. Demonstrates scale of software supply chain attacks through trusted package registries. Source: GitHub advisory
- Multiple malicious PyPI packages discovered stealing developer credentials. Typosquatting popular packages (ctx, phpass). Pattern: legitimate functionality + hidden credential theft. Source: Phylum, Snyk
- Malicious VS Code extensions discovered on marketplace stealing credentials and tokens. Supply chain attack through IDE extension ecosystem. Parallel to Chrome extension attacks (TL-0015) and OpenClaw skills. Source: Socket.dev
- AgentSkills specification published — standardized format for AI assistant skill packages. SKILL.md + frontmatter + companion scripts. Adopted by OpenClaw and other AI assistant platforms. No security model included in initial spec. Source: agentskills.io
- ClawHub skills registry launched as the primary distribution point for OpenClaw skills. Open submission model with automated format validation but minimal security review. Publisher accounts created with email-only verification. Source: clawhub.com
- OpenClaw platform undergoes naming evolution (originally MoltBot, then ClawdBot, then OpenClaw). Name changes create confusion around 'official' vs 'community' skills and enable social engineering around platform authenticity. Source: OpenClaw documentation
- CVE-2026-25253 disclosed — OpenClaw RCE via token exfiltration. Specific code vulnerability in token handling (documented in TL-0008/TL-0044). Separate from the registry poisoning campaign but demonstrates OpenClaw attack surface. Source: OpenClaw security advisory
- Malicious skill publishing campaign begins on ClawHub. First batch of ~50 malicious skills published from 12 newly created publisher accounts. Skills target popular categories: git helpers, code formatters, API testers. Source: ClawHub audit logs
- Second wave: ~80 additional malicious skills from 15 new accounts. Categories expand to database connectors, deployment automation, and language translation. Naming increasingly aggressive — direct typosquats of popular skills. Source: ClawHub audit logs
- Third wave: ~100 malicious skills from 20 accounts. Campaign reaches peak publication rate. Skills now include sophisticated prompt injection variants that instruct the AI agent to exfiltrate data using its own tool capabilities. Source: ClawHub audit logs
- Security researcher discovers anomalous network traffic from OpenClaw instance after installing 'git-helper-pro' skill. Traces exfiltration to attacker C2 domain. Reports to OpenClaw maintainers with IOCs and malicious skill analysis. Source: Security researcher report
- First Exploitation
- ClawHub suspends all 47 malicious publisher accounts and removes 230+ identified malicious packages. Emergency registry audit initiated. Source: ClawHub status page
- OpenClaw publishes security advisory with IOCs, affected skill names, and remediation guidance. Recommends immediate credential rotation for all users who installed third-party skills. Source: OpenClaw security advisory
- OpenClaw v4.2.1 released with skill sandboxing improvements, mandatory script hash verification, and skill provenance tracking. Skills from unverified publishers now display security warnings. Source: OpenClaw release notes
- Discovered
- Disclosed
- ClawHub implements mandatory publisher verification (GitHub identity + email verification), automated security scanning for skill submissions (static analysis of scripts for credential access patterns, network exfiltration, environment variable harvesting), and rate limiting on new publisher registrations. Source: ClawHub announcement
- ThreadLinqs Intelligence revalidates TL-2026-0043 with focus on registry poisoning campaign, skill trust model exploitation, and AI assistant supply chain attack surface — distinct from TL-0044 (CVE-2026-25253 code vulnerability). Source: ThreadLinqs Intelligence
- As of 2026-05-29, the ClawHavoc ClawHub poisoning campaign is still active and larger than recorded: Koi Security/Antiy/Bitdefender found 341→824+ malicious skills (~20% of registry) and 1,184 historical packages from 12 accounts, now dropping Atomic macOS Stealer via ClickFix. No actor takedown; variants reappear under new names and evade VirusTotal scanning, so the record's "CONTAINED"/230-package scope is outdated.
Sources cited for Malicious OpenClaw/MoltBot Skills
- BleepingComputer: Malicious MoltBot skills used to push password-stealing malware
- OpenClaw Skills Documentation
- ClawHub Skills Registry
- OpenClaw Security Advisory: Malicious Skills Campaign
- OpenClaw GitHub Repository
- AgentSkills Specification
- OpenClaw Sandboxing Documentation
- NPM Supply Chain: ua-parser-js Compromise
- Phylum: Malicious PyPI Packages Analysis
- Socket.dev: NPM/PyPI Supply Chain Analysis
- Snyk: State of Open Source Security
- OpenClaw v4.2.1 Release — Skill Sandboxing
- MITRE ATT&CK: Supply Chain Compromise
- OpenClaw Community Discord
Threats related to Malicious OpenClaw/MoltBot Skills
Detection coverage for TL-2026-0043
As of 2026-02-03, Threadlinqs Intelligence publishes 15 detection rule(s) for TL-2026-0043 across Splunk SPL, Microsoft KQL and Sigma, covering 42 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.