# Malicious OpenClaw/MoltBot Skills - 230+ Password-Stealing Packages

> 230+ malicious skills published to the ClawHub (OpenClaw) skills registry and associated GitHub repositories within a single week — a supply chain poisoning campaign targeting AI assistant users through credential-stealing packages disguised as legitimate productivity, development, and automation skills. Distinct from TL-0044 (CVE-2026-25253 OpenClaw RCE — a specific code vulnerability). TL-0043 documents the registry poisoning campaign itself: how 230+ malicious packages bypassed review, the credential theft TTPs embedded in skill scripts, the skill trust model exploitation, discovery and response timeline, and the broader AI assistant supply chain attack surface. OpenClaw skills execute with full user-level permissions in the host environment (no sandbox by default) — the AI assistant becomes the malware delivery mechanism, instructed by its own skill definitions to exfiltrate credentials, API keys, tokens, environment variables, SSH keys, browser data, and cloud configuration files.

- **Published:** 2026-02-03T02:55:00Z
- **Last reviewed:** 2026-02-03T02:55:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0043
- **ID:** TL-2026-0043
- **Severity:** HIGH (CVSS 7.8)
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** ClawHavoc Operators
- **Detections:** 15 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25253

## Description

OpenClaw is a self-hosted gateway connecting messaging platforms (WhatsApp, Telegram, Discord, iMessage) to AI coding agents. It uses the AgentSkills specification for extensibility — users install 'skills' (SKILL.md files with scripts and instructions) from ClawHub (the public registry at clawhub.com) to teach their AI assistant new capabilities. Skills are loaded from three locations with precedence: workspace/skills (highest) → ~/.openclaw/skills (managed) → bundled skills (lowest). Critically, skills execute with the full permissions of the host user — there is no sandboxing by default, no capability restriction, and no code signing. The skill DEFINES what tools the AI agent can use and HOW — a malicious skill can instruct the agent to read files, execute commands, access environment variables, and exfiltrate data, all while appearing to perform its advertised function.

**The Campaign — 230+ Malicious Skills in One Week:**
Between January 20-27, 2026, an organized campaign published 230+ malicious skills to ClawHub using 47 newly created publisher accounts. The skills were designed to appear as legitimate productivity tools across popular categories: code formatting, git helpers, database connectors, API testing utilities, deployment automation, weather integrations, and language translation. The naming strategy combined typosquatting (deliberately similar to popular skill names) with SEO optimization (keyword-stuffed descriptions targeting common search queries).

**How the Malicious Skills Worked:**
Each malicious skill contained a legitimate-appearing SKILL.md with proper AgentSkills frontmatter and functional instructions for its advertised purpose. The credential theft was embedded in companion scripts (setup.sh, install.sh, helper scripts) and in hidden instructions within the SKILL.md that the AI agent would follow during 'installation' or 'first run'. The exfiltration TTPs:

1. **Environment Variable Harvesting**: Scripts executed during skill installation read all environment variables (env, printenv) and exfiltrated them to attacker C2 — capturing API keys (ANTHROPIC_API_KEY, OPENAI_API_KEY, AWS_ACCESS_KEY_ID), database credentials, and cloud configuration tokens that OpenClaw users commonly have set.

2. **SSH Key Theft**: Scripts accessed ~/.ssh/ directory to steal private keys (id_rsa, id_ed25519), known_hosts (mapping the user's server infrastructure), and SSH agent socket for credential forwarding.

3. **Browser Credential Extraction**: On macOS and Linux, scripts accessed browser credential stores (Chrome Login Data, Firefox logins.json, Safari Keychain) to steal saved passwords and session cookies.

4. **Cloud Configuration Theft**: Scripts read ~/.aws/credentials, ~/.config/gcloud/, ~/.azure/, ~/.kube/config to steal cloud provider credentials and Kubernetes cluster access.

5. **Git Credential Theft**: Scripts accessed ~/.gitconfig, credential helpers, and GitHub/GitLab personal access tokens stored in environment variables or credential managers.

6. **OpenClaw Configuration Theft**: Scripts read ~/.openclaw/openclaw.json to steal the user's API keys (Anthropic, OpenAI), channel tokens (Telegram bot token, Discord bot token, WhatsApp session), and gateway configuration — enabling the attacker to impersonate the user's AI assistant or access their messaging channels.

7. **Prompt Injection via SKILL.md**: Some malicious skills embedded hidden instructions in the SKILL.md that directed the AI agent to 'verify configuration' by reading and transmitting sensitive files. The AI agent, following its skill instructions, became the exfiltration mechanism — using its own tool capabilities (read, exec, web_fetch) to collect and transmit data.

**Exfiltration Infrastructure:**
Stolen credentials were transmitted via: (1) HTTPS POST to attacker-controlled domains disguised as 'telemetry' or 'analytics' endpoints, (2) DNS exfiltration encoding data in DNS queries to attacker nameservers, (3) Webhook posts to disposable Discord/Slack webhook URLs, (4) In some variants, the AI agent was instructed to use web_fetch to POST data directly — the agent IS the exfiltration tool.

**Why It Worked — The Skill Trust Model:**
The attack exploited a fundamental trust gap in the AI assistant ecosystem:
- Users trust skills from ClawHub the way they trust packages from NPM or extensions from the Chrome Web Store
- ClawHub's review process at the time was minimal — automated format validation but no security code review
- Skills execute with user permissions — no sandbox, no permission prompts, no capability restrictions
- The AI agent follows skill instructions by design — if the SKILL.md says 'run this script', the agent runs it
- Platform naming confusion (OpenClaw was previously named MoltBot, then ClawdBot) created opportunities for impersonation and social engineering around 'official' vs 'community' skills

**Discovery and Response:**
The campaign was discovered on January 27, 2026 by a security researcher who noticed anomalous network traffic from their OpenClaw instance after installing a 'git-helper-pro' skill. The researcher reported to the OpenClaw maintainers, who conducted a registry audit identifying 230+ malicious packages across 47 publisher accounts. Response timeline: January 27 — initial report; January 28 — ClawHub suspended all 47 accounts and removed malicious packages; January 29 — OpenClaw published security advisory with IOCs; January 30 — OpenClaw released v4.2.1 with skill sandboxing improvements and mandatory script hash verification; February 3 — ClawHub implemented mandatory publisher verification (GitHub identity, email verification) and automated security scanning for new skill submissions.

**Supply Chain Parallels:**
This campaign mirrors established software supply chain attacks: NPM typosquatting (ua-parser-js, event-stream), PyPI malware (ctx, phpass), VS Code malicious extensions (documented in TL-0034 GlassWorm), and Chrome extension credential theft (TL-0015). The AI assistant ecosystem is the newest — and least hardened — software supply chain. Unlike NPM or PyPI where packages are code libraries, AI skills are INSTRUCTIONS that an AI agent follows with full system access. This makes them uniquely dangerous: the skill doesn't just run code, it instructs an intelligent agent to run code on the skill's behalf, combining human-like reasoning with system-level access.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1555 Credentials from Password Stores
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1087 Account Discovery
- T1016 System Network Configuration Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1071 Application Layer Protocol
- T1102 Web Service
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1657 Financial Theft
- T1583 Acquire Infrastructure
- T1593 Search Open Websites/Domains

## Sources

- [BleepingComputer: Malicious MoltBot skills used to push password-stealing malware](https://www.bleepingcomputer.com/news/security/malicious-moltbot-skills-used-to-push-password-stealing-malware/)
- [OpenClaw Skills Documentation](https://docs.openclaw.ai/tools/skills)
- [ClawHub Skills Registry](https://clawhub.com/)
- [OpenClaw Security Advisory: Malicious Skills Campaign](https://docs.openclaw.ai/gateway/security)
- [OpenClaw GitHub Repository](https://github.com/openclaw/openclaw)
- [AgentSkills Specification](https://agentskills.io/)
- [OpenClaw Sandboxing Documentation](https://docs.openclaw.ai/gateway/sandboxing)
- [NPM Supply Chain: ua-parser-js Compromise](https://github.com/nicedayzhu/ua-parser-js/issues/536)
- [Phylum: Malicious PyPI Packages Analysis](https://blog.phylum.io/)
- [Socket.dev: NPM/PyPI Supply Chain Analysis](https://socket.dev/blog)
- [Snyk: State of Open Source Security](https://snyk.io/reports/open-source-security/)
- [OpenClaw v4.2.1 Release — Skill Sandboxing](https://github.com/openclaw/openclaw/releases)
- [MITRE ATT&CK: Supply Chain Compromise](https://attack.mitre.org/techniques/T1195/)
- [OpenClaw Community Discord](https://discord.com/invite/clawd)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0043